iportal integrating with Central authentication services (CAS)

<p>Hi,</p>
<p> </p>
<p>I'm working on Birt reports/dashboards. We are using the Central authentication services(CAS) for SSO purpose. I am trying to configure iportal with cas authentication but could not succeed . I got below errors and iportal is down.</p>
<p> </p>
<div>Feb 04, 2015 6:01:31 PM org.apache.shindig.gadgets.oauth.OAuthModule$OAuthStoreProvider loadDefaultKey</div>
<div>WARNING: Couldn't load OAuth signing key. To create a key, run:</div>
<div> openssl req -newkey rsa:1024 -days 365 -nodes -x509 -keyout testkey.pem \</div>
<div> -out testkey.pem -subj '/CN=mytestkey'</div>
<div> openssl pkcs8 -in testkey.pem -out oauthkey.pem -topk8 -nocrypt -outform PEM</div>
<div> </div>
<div>Then edit shindig.properties and add these lines:</div>
<div>shindig.signing.key-file=<path-to-oauthkey.pem></div>
<div>shindig.signing.key-name=mykey</div>
<div> </div>
<div>Feb 04, 2015 6:01:31 PM org.apache.shindig.gadgets.oauth.OAuthModule$OAuthCrypterProvider <init></div>
<div>INFO: Using random key for OAuth client-side state encryption</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.core.StandardContext startInternal</div>
<div>SEVERE: Error filterStart</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.core.StandardContext startInternal</div>
<div>SEVERE: Context [/iportal] startup failed due to previous errors</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads</div>
<div>SEVERE: The web application [/iportal] appears to have started a thread named [com.google.inject.internal.Finalizer] but has failed to stop it. This is very likely to create a memory leak.</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads</div>
<div>SEVERE: The web application [/iportal] appears to have started a thread named [net.sf.ehcache.CacheManager@1ac11739] but has failed to stop it. This is very likely to create a memory leak.</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.loader.WebappClassLoader checkThreadLocalMapForLeaks</div>
<div>SEVERE: The web application [/iportal] created a ThreadLocal with key of type [org.apache.shindig.common.xml.XmlUtil$2] (value [org.apache.shindig.common.xml.XmlUtil$2@4299eb1d]) and a value of type [org.apache.xerces.jaxp.DocumentBuilderImpl] (value [org.apache.xerces.jaxp.DocumentBuilderImpl@71adf14]) but failed to remove it when the web application was stopped. Threads are going to be renewed over time to try and avoid a probable memory leak.</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.loader.WebappClassLoader checkThreadLocalMapForLeaks</div>
<div>SEVERE: The web application [/iportal] created a ThreadLocal with key of type [com.google.inject.InjectorImpl$1] (value [com.google.inject.InjectorImpl$1@752b9db0]) and a value of type [java.lang.Object[]] (value [[Ljava.lang.Object;@27dc9e9]) but failed to remove it when the web application was stopped. Threads are going to be renewed over time to try and avoid a probable memory leak.</div>
<div>Feb 04, 2015 6:01:32 PM org.apache.catalina.startup.HostConfig deployWAR</div>
<div> </div>
<div>Could you please guide me how to do.</div>
<div>Thanks,</div>
<div>Srinivas</div>

Find more posts tagged with

Comments

JFreeman

<p>Which version of iServer/iHub are you using?</p>
<p> </p>
<p>The error from the catalina log file "<span style="color:rgb(40,40,40);font-family:'Source Sans Pro', sans-serif;">Feb 04, 2015 6:01:32 PM org.apache.catalina.core.StandardContext startInternal </span><span style="color:rgb(40,40,40);font-family:'Source Sans Pro', sans-serif;">SEVERE: Error filterStart" is a generic tomcat error that doesn't provide details on what caused it. </span>There should be another log from tomcat that will contain the full stack trace that will provide further insight.</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p>Thank you for your reply.You are right Jesse due to older version slf4j-api.jar cause above errors. I'm using the latest F-Type server. Above errors are resolved and iportal deployed successfully in tomcat -7 server.</p>
<p> </p>
<p>I have added the below filters for CAS authentication in iportal web.xml file.</p>
<p> </p>
<div></div>
<div> </div>
<div><filter></div>
<div> <filter-name>CAS Authentication Filter</filter-name></div>
<div> <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class></div>
<div> <init-param></div>
<div><param-name>casServerLoginUrl</param-name></div>
<div><param-value><a data-ipb='nomediaparse' href='https://localhost:8443/cas/login'>https://localhost:8443/cas/login</param-value></a></div>
<div> </init-param></div>
<div> <init-param></div>
<div><param-name>serverName</param-name></div>
<div><param-value>localhost:8443</param-value></div>
<div> </init-param></div>
<div> </filter></div>
<div><filter-mapping></div>
<div><filter-name>CAS Authentication Filter</filter-name></div>
<div><url-pattern>/iportal/login.do/</url-pattern></div>
<div></filter-mapping></div>
<div> </div>
<div></div>
<div> </div>
<div>we are getting CAS login page before accessing the iportal login page. We have to use CAS authentication instead of Birt iportal authentication. Authorization should be take care by iportal only. How to achieve? Could you please guide .</div>
<div> </div>
<div>Thanks,</div>
<div>Srinivas</div>

JFreeman

<p>I would recommend looking into configuring an iPortal Security Extension(IPSE).</p>
<p> </p>
<p>Take a look at the <a data-ipb='nomediaparse' href='http://developer.actuate.com/be/documentation/Manualsihub3/ihub-integration-guide.pdf'>Integrating Applications into BIRT iHub</a> documentation. Chapter 19 in particular will have the details about implementing an IPSE.</p>
<p> </p>
<p>There is also a reference example available on GitHub here: <a data-ipb='nomediaparse' href='https://github.com/ActuateBIRT/ServerIntegrationIPSEExample'>https://github.com/ActuateBIRT/ServerIntegrationIPSEExample</a></p>

Srinivas Yarra

<p>Thank you Jesse for your reply. </p>

JFreeman

<p>You're welcome.</p>
<p>Let us know if you have any additional questions.</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p>We have configured the IPSE Security in iportal and it's working fine. But if we use the CAS authentication (<a data-ipb='nomediaparse' href='http://jasig.github.io/cas/4.0.x/protocol/REST-Protocol.html'>http://jasig.github.io/cas/4.0.x/protocol/REST-Protocol.html</a>) then it is redicting to iportal login page.</p>
<p> </p>
<p>My Requirements:-</p>
<p> </p>
<p>We have to use CAS authentication then it creates tickets and session for requested iportal url. Iportal should accept CAS cookies/session and display iportal pages without login page. Iportal should take care the authorization and CAS will take the authentication.</p>
<p> </p>
<p>we need to skip authentication filter at iportal side. Could you please help us.</p>
<p> </p>
<p>Thanks,</p>
<p>Srinivas</p>

JFreeman

<p>Do you receive any errors in the IPSE code when you are passing the session/token from CAS?</p>
<p> </p>
<p>I would recommend adding additional debugging to the IPSE code as well as using a tool such as Fiddler to capture the traffic and see what is happening when it isn't accepting the token.</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p style="color:rgb(40,40,40);font-family:'Source Sans Pro', sans-serif;">Thank you Jesse for your reply. We did not see any errors. we have changed welcome page instead of iportal login.jsp in web.xml as like </p>
<div><welcome-file-list></div>
<div><welcome-file>/test.jsp</welcome-file></div>
<div></welcome-file-list></div>
<div> </div>
<div>Now we are getting test.jsp after authenticating at CAS through IPSE class file as landing page; but we are not getting userInfoBean data from session means login user name is not null. if we resubmit <a data-ipb='nomediaparse' href='http://localhost:8080/iportal'>http://localhost:8080/iportal</a>again at browser level then it is displaying user name. It is not getting user data at first time. </div>
<div> </div>
<div>Could you please help us what might be wrong.</div>
<div> </div>
<div>Thanks,</div>
<div>Srinivas</div>

JFreeman

<p>Have you configured iPortal to be using your IPSE class?</p>
<p> </p>
<p>Within the web.xml for iPortal (located in AC_SERVER_HOME/web/iportal/WEB-INF) there is the SECURITY_ADAPTER_CLASS property that needs to be set to point to your IPSE class.</p>
<p> </p>
<p>Please note, you will need to restart the iHub in order for the changes made in the web.xml to take effect.</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p>We have configured the SampleIPSE class in web.xml as per instructions. We have seen control coming to authenticate method in IPSE class. I have added below code in SampleIPSE file.</p>
<pre class="_prettyXprint _lang-nocode">
try {
String[] userArr = {u}; // u,p is userid and password from request params
String[] passArr = {p};
String[] volumeArr ={"Default Volume"};
request.getParameterMap().put("userid", userArr);
request.getParameterMap().put("password", passArr);
request.getParameterMap().put("volume", volumeArr);
AcRequestHandlerBean acRequestHandlerBean = new AcRequestHandlerBean(request);
UserInfoBean userInfoBean1 = acRequestHandlerBean.getUserInfoBeanFromSession();
SampleIPSE.log(" userInfoBean1 :"+userInfoBean1);
}catch(Exception ex) {ex.printStackTrace();}

</pre>
<p>we are getting below log information </p>
<div> </div>
<div>3/4/15 9:48:20 PM: userInfoBean1 :getFilter=</div>
<div>getLocale=en_US</div>
<div>getPassword=</div>
<div>getDefaultVolume=Default Volume</div>
<div>getVolumeProfile=</div>
<div>getRepositoryType=enterprise</div>
<div>getFeatureOptionsBean=com.actuate.activeportal.beans.FeatureOptionsBean@34bf0e4b</div>
<div>getSideBarSelected=</div>
<div>getDefaultServerURL=<a data-ipb='nomediaparse' href='http://localhost:8000'>http://localhost:8000</a></div>
<div>getDefaultUserName=</div>
<div>getAdminRights=</div>
<div>getSideBarFeatures=[Lcom.actuate.activeportal.functionality.config.Feature;@6b4378fa</div>
<div>getDefaultAnalyticsExpLevel=Novice</div>
<div>getDashboardTemplateType=default</div>
<div>getMaxJobPriority=1</div>
<div>getVolumeProperty=</div>
<div>getExternalUserPropertyNames=</div>
<div>getShowdocuments=true</div>
<div>getShowexecutables=true</div>
<div>getShowfolders=true</div>
<div>getMultivolumeParameter=</div>
<div>getArchiveLibrary=</div>
<div>getArchiveServiceCmd=</div>
<div>getEventPollingInterval=</div>
<div>getEventPollingDuration=</div>
<div>getEventLagTime=</div>
<div>getEnableCustomEvent=</div>
<div>getIvUserSession=</div>
<div>getInfoAppUserSession=</div>
<div>getBRSUserSession=</div>
<div>getDaUserSession=</div>
<div>getDashUserSession=</div>
<div>getDashboardTemplatePath=</div>
<div>getVolumeDefaultDashboard=/__default_dashboard.dashboard</div>
<div>getDefaultDashboardLayout=2column</div>
<div>getFreeFormLayoutShowGrid=true</div>
<div>getFreeFormLayoutSnapToGrid=true</div>
<div>getAutoSaveDashboardDelay=30</div>
<div>getPersonalDashboardPath=</div>
<div>getCurrentfolder=/</div>
<div>getInternalid=</div>
<div>getIportalid=</div>
<div>getUserid=</div>
<div>getServerurl=<a data-ipb='nomediaparse' href='http://localhost:8000'>http://localhost:8000</a></div>
<div>getSystemname=</div>
<div>getHomefolder=</div>
<div>getUserAgent=com.actuate.activeportal.beans.UserAgentBean@1abb9c1a</div>
<div>getSkinConfig=getPrimaryInterface=interface com.actuate.activeportal.skin.config.Skin</div>
<div>getType=treeview</div>
<div>getDescription=Tree View Skin</div>
<div>getGroups=com.actuate.activeportal.skin.config.impl.SkinTypeImpl$GroupsTypeImpl@c8c56dd</div>
<div>getClass=class com.actuate.activeportal.skin.config.impl.SkinImpl</div>
<div> </div>
<div>getSkinName=treeview</div>
<div>getRoleNames=</div>
<div>getView=Categories</div>
<div>getProfile=com.actuate.activeportal.beans.ProfileBean@13057cac</div>
<div>getOnlylatest=false</div>
<div>getFeatures=[Lcom.actuate.activeportal.functionality.config.Feature;@4d3c09f5</div>
<div>getUsageTerms=</div>
<div>getAuthid=</div>
<div>getAcLocale=en_US</div>
<div>getTimezone=com.actuate.reportcast.utils.AcTimeZone@6ec86010</div>
<div>getVolume=Default Volume</div>
<div>getFreeFormLayoutDefaultGridSpacing=18px</div>
<div>getClass=class com.actuate.activeportal.beans.UserInfoBean</div>
<div> </div>
<div>As per server logs it is calling below sequence order</div>
<div>Requested for localhost:8080/iportal</div>
<div>1. CAS login.jsp</div>
<div>2.authentication at CAS level</div>
<div>3.redirect to requested page localhost:8080/iportal but our landing page is test.jsp.</div>
<div>4.displaying test.jsp with empty userinfobean object.</div>
<div>5.SampleIPSE.authenticate(req);</div>
<div> </div>
<div>we are setting user/pass information at SampleIPSE.authenticate method at end.</div>
<div> </div>
<div>we want below sequence :</div>
<div>1.<a data-ipb='nomediaparse' href='http://localhost:8080/iportal'>http://localhost:8080/iportal</a> -->requested by user at browser</div>
<div>2.go to cas/login.jsp</div>
<div>3.authenticate and create user session at cas level</div>
<div>4. redirected to original page <a data-ipb='nomediaparse' href='http://localhost:8080/iportal'>http://localhost:8080/iportal</a></div>
<div>5.SampleIPSE.authenticate(req) --> it should get user/pass/session from request object</div>
<div>6.display the welcome page i.e. /test.jsp with valid userinfobean object.</div>
<div> </div>
<div>SampleIPSE.authenticate() method should call at the time of iportal welcome page.</div>
<div> </div>
<div>Thanks,</div>
<div>Srinivas</div>

JFreeman

<p>Can you provide your SampleIPSE code?</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p>Please find the SampleIPSE.java file in the attachments. </p>
<p> </p>
<p>Thanks,</p>
<p>Srinivas</p>

JFreeman

<p>I do not believe trying to set a userinfobean with the authenticate method like you are is going to work or perpetuate it to your test.jsp.</p>
<p> </p>
<p>In order for the IPSE to work properly, the values of the getUserName and getPassword methods of the class need to return valid username and password for the volume. I'm not sure this is happening properly with the other customization's you have made to pull in the user information from the session.</p>
<p> </p>
<p>Can you attache the full log file that is generated when the SampleIPSE class runs?</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p>Please find attached zip file contains log file and SampleIPSE.java file in the attachments.</p>
<p> </p>
<p>Thanks,</p>
<p>Srinivas</p>

Srinivas Yarra

<p>Hi Jesse,</p>
<p> </p>
<p>We upgraded to iHub3.1 server. Is it possible to use rest api in <span style="color:rgb(40,40,40);font-family:'Source Sans Pro', sans-serif;">IPSE .</span></p>
<p> </p>
<p><span style="color:rgb(40,40,40);font-family:'Source Sans Pro', sans-serif;">Thanks,</span></p>
<p><span style="color:rgb(40,40,40);font-family:'Source Sans Pro', sans-serif;">Srinivas</span></p>

JFreeman

<p>I would need to know more about how you are wanting to use the REST API within the IPSE.</p>
<p>Can you elaborate on how you are wanting to use the REST API with your IPSE?</p>

Srinivas Yarra

<p>Hi Freeman,</p>
<p> </p>
<p>Thank you for your reply. We are writing a authentication handler to authenticate the iHub3.1 iportal through CAS. As I said. we are using CAS 4.x authentication for my application(SSO) so user should not enter user/password while connecting iportal to see his/her reports/dashboards from my application. We are providing separate link from my application to connect the iHub3.1 iportal for creating his/her own dashboards as well as to share his objects within his/her groups.</p>
<p> </p>
<p>We are facing problem while authenticating iportal through CAS 4.x from my apps without iportal login page. CAS 4.X will support out of box authentication using Restlet api.</p>
<p> </p>
<p>Thanks,</p>
<p>Srinivas</p>

JFreeman

<p>The rest API will provide an auth id after performing a login call. However, that auth id is not going to be what is needed/used for authenticating against iPortal with an IPSE. For that you have to use extend the iPortalSecurityAdapter class as demonstrated in the IPSE example.</p>

Srinivas Yarra

<p>Thank you Freeman for your reply.</p>