CAS Disconnessione singola non funzionante

Question

Sto implementando Single-Sign-On + Single-Log-Out in ambiente Java EE tramite CAS.

Sul lato autenticazione ho la cas-server-webapp v4.0.1. Quindi 2 semplici app Web Java + Spring MVC con lo cas-client-corev3.1.10.

Nessun problema riguardante il single sign on. Se accedo/app1 vengo reindirizzato alla pagina di accesso cas in cas-server-webapp. Dopo l'input + pass dell'utente, viene reindirizzato a/app1 autenticato correttamente. Inoltre, se si naviga in/app2, questo riceve il suo ticket di autenticazione. Fin qui tutto bene.

Per quanto riguarda la singola logout, forse ho frainteso il doc: ma questo è quello che faccio:

app1 e app2 hanno ciascuna un controller Primavera mappato per/logout url:

@Controller 
public class LogoutController { 

    @RequestMapping("/logout") 
    public String logout(HttpSession session){ 
     session.invalidate(); 
     return "redirect:https://cas-server-host:8443/cas/logout?service=http://cas-server-host:9080/cas1/action/index"; 
    } 
} 

Vale a dire, invalidare la sessione http e reindirizzare all'url di logout del cas server in modo che i ticket vengano invalidati.

nel registro del server CAS vedo che distrugge il ticket TGT e invia una richiesta di disconnessione al filtro CAS di ogni app:

DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Removing ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org] from registry.> 
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Attempting to retrieve ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org]> 
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org] found in registry.> 
DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Ticket found. Processing logout requests and then deleting the ticket...> 
DEBUG [org.jasig.cas.logout.SamlCompliantLogoutMessageCreator] - <Generated logout message: [<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-13-TfRj1HnvAjpBjNIdaDvDMJUMXk7wffdXgB5" Version="2.0" IssueInstant="2015-02-10T12:18:18Z"><saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-16-aXpUJpwO4MQ09caXZRKX-cas01.example.org</samlp:SessionIndex></samlp:LogoutRequest>]> 
DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - <Sending logout request for: [http://localhost:9080/cas2]> 
DEBUG [org.jasig.cas.util.SimpleHttpClient] - <Attempting to access http://localhost:9080/cas2> 
DEBUG [org.jasig.cas.logout.SamlCompliantLogoutMessageCreator] - <Generated logout message: [<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-14-BaKvuaIbwxg9Le9H3QIvWORfNSE0dxaxsCE" Version="2.0" IssueInstant="2015-02-10T12:18:20Z"><saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-15-zaX6aojKs0PiggCles6J-cas01.example.org</samlp:SessionIndex></samlp:LogoutRequest>]> 
DEBUG [org.jasig.cas.util.SimpleHttpClient] - <Finished sending message to http://localhost:9080/cas2> 
DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - <Sending logout request for: [http://localhost:9080/cas1]> 
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Removing ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org] from registry> 
DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - <Attempting to retrieve ticket [TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org]> 
DEBUG [org.jasig.cas.util.SimpleHttpClient] - <Attempting to access http://localhost:9080/cas1> 
INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN 
============================================================= 
WHO: audit:unknown 
WHAT: TGT-9-inxrphuRfIFpkbPTvNf6v1bAx7RlR7IMeMUFU0aokNCdbZ43Ij-cas01.example.org 
ACTION: TICKET_GRANTING_TICKET_DESTROYED 
APPLICATION: CAS 
WHEN: Tue Feb 10 12:18:20 CET 2015 
CLIENT IP ADDRESS: 192.168.13.164 
SERVER IP ADDRESS: 192.168.13.164 
============================================================= 

Ora, supponiamo che mi sono collegato fuori da/CAS1, io sono rimandato alla pagina di login del cas-server. Senza accesso di nuovo, se accedo/app2, mi è permesso di navigare questa app come se fossi ancora autenticato e posso accedere sia al suo java.user.Principal sia alla sessione. Come può essere possibile? Non dovrebbe la richiesta di logout ricevuta in/app2 aver distrutto la sessione principale e http?

Answer 1

... colpa mia, come previsto mi mancava qualcosa. Ho dovuto includere il filtro Single Sign Out e Listener in entrambe le app:

<filter> 
     <filter-name>CAS Single Sign Out Filter</filter-name> 
     <filter-class>org.jasig.cas.client.session.SingleSignOutFilter 
     </filter-class> 
    </filter> 
    <filter-mapping> 
     <filter-name>CAS Single Sign Out Filter</filter-name> 
     <url-pattern>/*</url-pattern></filter-mapping> 
    <listener>  
     <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class> 
    </listener> 

    <filter> 
     <filter-name>CAS Authentication Filter</filter-name> 
     <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class> 
     <init-param> 
      <param-name>casServerLoginUrl</param-name> 
      <param-value>https://cas-server-host:8443/cas/login</param-value> 
     </init-param> 
     <init-param> 
      <param-name>service</param-name> 
      <param-value>http://localhost:9080/cas1</param-value> 
     </init-param> 
    </filter> 
    <filter-mapping> 
     <filter-name>CAS Authentication Filter</filter-name> 
     <url-pattern>/*</url-pattern> 
    </filter-mapping> 

    <filter> 
     <filter-name>CAS Validation Filter</filter-name> 
     <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class> 
     <init-param> 
      <param-name>casServerUrlPrefix</param-name> 
      <param-value>https://cas-server-host:8443/cas/</param-value> 
     </init-param> 
     <init-param> 
      <param-name>service</param-name> 
      <param-value>http://localhost:9080/cas1</param-value> 
     </init-param> 
    </filter> 
    <filter-mapping> 
     <filter-name>CAS Validation Filter</filter-name> 
     <url-pattern>/*</url-pattern> 
    </filter-mapping> 

    <filter> 
     <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> 
     <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class> 
    </filter> 
    <filter-mapping> 
     <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name> 
     <url-pattern>/*</url-pattern> 
    </filter-mapping>