Nabble - CAS Dev

Re: Integrating a SAML 2.0 IdP with CAS

2009-10-19T08:24:18Z

It should be possible to put an SP in front of CAS and then use the "trusted" method of authentication (i.e. getRemoteUser). You'll need custom plugins to translate the headers that the SP sends into the CAS principal.

Cheers,
Scott

On Mon, Oct 19, 2009 at 11:14 AM, Marvin Addison <marvin.addison@...> wrote:

> I found the following post, but I’m not aware of any further activity
>
> http://tp.its.yale.edu/pipermail/cas/2006-February/002162.html

This thread discusses fronting CAS with Shib, but I'm not aware of any
reasonable way to do that. It is very straightforward, on the other
hand, to front Shib with CAS -- CAS becomes the authentication
provider for Shib. I have written detailed instructions for this
setup at http://www.ja-sig.org/wiki/display/CASUM/Shibboleth-CAS+Integration.
Note that the Shibbolized services are _not_ part of the CAS SSO
session in this scenario; Shib and CAS maintain parallel and
independent SSO sessions. If you want that functionality, you are
likely to encounter substantial work customizing CAS and/or Shib. I
would recommend against it.

M

--
You are currently subscribed to cas-dev@... as: scott.battaglia@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Integrating a SAML 2.0 IdP with CAS

2009-10-19T08:14:17Z

> I found the following post, but I’m not aware of any further activity
>
> http://tp.its.yale.edu/pipermail/cas/2006-February/002162.html

This thread discusses fronting CAS with Shib, but I'm not aware of any
reasonable way to do that. It is very straightforward, on the other
hand, to front Shib with CAS -- CAS becomes the authentication
provider for Shib. I have written detailed instructions for this
setup at http://www.ja-sig.org/wiki/display/CASUM/Shibboleth-CAS+Integration.
Note that the Shibbolized services are _not_ part of the CAS SSO
session in this scenario; Shib and CAS maintain parallel and
independent SSO sessions. If you want that functionality, you are
likely to encounter substantial work customizing CAS and/or Shib. I
would recommend against it.

M

--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Integrating a SAML 2.0 IdP with CAS

2009-10-19T08:02:37Z

Dear all,

In our scenario, we have a number of Web application which rely on a CAS server for authentication and SSO.

We are also planning the deployment of a SAML 2.0 IdP to enable federation with external domains.

The ideal scenario is that SSO will work both on internal and external/federated services. Our wish would be to preserve the CAS-ified applications and work at the CAS server level so that this can act as a gateway to a SAML 2.0 IdP, get the SAML assertion and translate back to a CAS token for the web applicatons.

I found the following post, but I’m not aware of any further activity

http://tp.its.yale.edu/pipermail/cas/2006-February/002162.html

I’d like to get in touch with people who implemented the above scenario to understand the approach and impact.

Thanks, Sergio

Sergio Andreozzi

CeSIA - Centro per lo Sviluppo e Gestione Servizi Informatici d’Ateneo

Alma Mater Studiorum - Università di Bologna

Viale Filopanti, 3 - 40126 Bologna - Italy

+39 051 209 5845 - http://www.cesia.unibo.it

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

How to use Verisign certicate in Tomcat (for SSL) and WITHOUT a .keystore file

2009-10-19T07:47:15Z

Hi,

I want to use secure certificates provided by thirdparty vendors like Verisign.
I do NOT want to use keystore to generate certificates for me.

Now, when I enable SSL in my Tomcat, it expects a .keystore file.

Can anyone let me know how to avoid this .keystore file and use a verisign certificate (for example)
when I enable SSL in my Tomcat?

Thanks,
Raja

Re:JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

2009-10-19T06:00:23Z

Finally we have tried with JRE 7 early acces (build 74) and it works. We have to wait until next release of JRE 6 update 18 to have a estable version of JRE in production working.

Thanks !
--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

2009-10-17T17:14:40Z

I'm not sure because we don't use it. Let us know if it works for you though!

2009/10/16 José Antonio Ruiz <jaruizcarrillo%2Bcas@...>

Hello Scott.

I've tried with jcifs-1.3.12 but error persist.
I've been looking for a newer version of jcifs-ext but in the official site (http://sourceforge.net/projects/jcifs-ext/) there is no one (latest is 0.9.4). However, in https://labs.jboss.com/community/wiki/NegotiateKerberos (at the bottom) there is what looks like a newer version (jcifs-ext-1.2.3.jar). I've tried it but I obtain the same results: SPNEGO autenticacion works with firefox and with all internet explorer versions without patch KB974455 but not if I intall it.

In http://groups.google.com/group/comp.protocols.kerberos/browse_thread/thread/77d23b537e917d6a?pli=1 they talks about a related problem and they mention that it may be relatad to the JGSS API. They also mention that it will be resolved in a coming update of JRE. What do you think about it?
--

You are currently subscribed to cas-dev@... as: scott.battaglia@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re:JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

2009-10-16T00:44:15Z

Hello Scott.

I've tried with jcifs-1.3.12 but error persist.
I've been looking for a newer version of jcifs-ext but in the official site (http://sourceforge.net/projects/jcifs-ext/) there is no one (latest is 0.9.4). However, in https://labs.jboss.com/community/wiki/NegotiateKerberos (at the bottom) there is what looks like a newer version (jcifs-ext-1.2.3.jar). I've tried it but I obtain the same results: SPNEGO autenticacion works with firefox and with all internet explorer versions without patch KB974455 but not if I intall it.

In http://groups.google.com/group/comp.protocols.kerberos/browse_thread/thread/77d23b537e917d6a?pli=1 they talks about a related problem and they mention that it may be relatad to the JGSS API. They also mention that it will be resolved in a coming update of JRE. What do you think about it?
--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

2009-10-15T20:37:53Z

We're pretty far behind on our JCIFS version. Would you be able to try out a newer library version and let us know if it works? Then we can upgrade the distribution.

Cheers,
Scott

2009/10/15 José Antonio Ruiz <jaruizcarrillo%2Bcas@...>

Hello.

We have CAS 3.3 in production (tomcat 6.0.18, JRE 1.6 update 16) and after installing patch KB974455 in Internet Explorer, SPNEGO validation has stopped working.

We have been investigating and we have found that it may be related to Extended Protection for Authentication (http://support.microsoft.com/?scid=kb%3Ben-us%3B968389&x=14&y=13). It also may be a problem with explorer in windows 7 that come with that extended protection activated (we don't have try it).

Any suggestion?

Here is de stack trace:

jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
at jcifs.spnego.Authentication.process(Authentication.java:235)
at org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler.doAuthentication(JCIFSSpnegoAuthenticationHandler.java:56)
at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:71)
at org.jasig.cas.authentication.AuthenticationManagerImpl.authenticate(AuthenticationManagerImpl.java:88)
at org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTicket(CentralAuthenticationServiceImpl.java:417)
at org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction.doExecute(AbstractNonInteractiveCredentialsAction.java:80)
at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:192)
at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.java:146)
at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.java:59)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:156)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.TransitionableState.onEvent(TransitionableState.java:107)
at org.springframework.webflow.engine.Flow.onEvent(Flow.java:534)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEvent(RequestControlContextImpl.java:205)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:161)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.TransitionableState.onEvent(TransitionableState.java:107)
at org.springframework.webflow.engine.Flow.onEvent(Flow.java:534)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEvent(RequestControlContextImpl.java:205)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:161)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Flow.start(Flow.java:521)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.start(RequestControlContextImpl.java:193)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:177)
at org.springframework.webflow.executor.FlowExecutorImpl.launch(FlowExecutorImpl.java:187)
at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRequest(FlowRequestHandler.java:125)
at org.springframework.webflow.executor.mvc.FlowController.handleRequestInternal(FlowController.java:165)
at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:875)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:809)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:571)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:501)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:568)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:857)
at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:565)
at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1509)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor64.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at jcifs.spnego.Authentication.processKerberos(Authentication.java:430)
... 62 more
Caused by: java.security.PrivilegedActionException: java.lang.reflect.InvocationTargetException
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Unknown Source)
... 66 more
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor68.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517)
... 68 more
Caused by: GSSException: Channel binding mismatch (Mechanism level: ChannelBinding not provided!)
at sun.security.jgss.krb5.InitialToken$OverloadedChecksum.<init>(Unknown Source)
at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source)
at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)
at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
... 72 more
--
You are currently subscribed to cas-dev@... as: scott.battaglia@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

2009-10-15T00:45:08Z

Hello.

We have CAS 3.3 in production (tomcat 6.0.18, JRE 1.6 update 16) and after installing patch KB974455 in Internet Explorer, SPNEGO validation has stopped working.

We have been investigating and we have found that it may be related to Extended Protection for Authentication (http://support.microsoft.com/?scid=kb%3Ben-us%3B968389&x=14&y=13). It also may be a problem with explorer in windows 7 that come with that extended protection activated (we don't have try it).

Any suggestion?

Here is de stack trace:

jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
at jcifs.spnego.Authentication.process(Authentication.java:235)
at org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler.doAuthentication(JCIFSSpnegoAuthenticationHandler.java:56)
at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:71)
at org.jasig.cas.authentication.AuthenticationManagerImpl.authenticate(AuthenticationManagerImpl.java:88)
at org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTicket(CentralAuthenticationServiceImpl.java:417)
at org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction.doExecute(AbstractNonInteractiveCredentialsAction.java:80)
at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:192)
at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.java:146)
at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.java:59)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:156)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.TransitionableState.onEvent(TransitionableState.java:107)
at org.springframework.webflow.engine.Flow.onEvent(Flow.java:534)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEvent(RequestControlContextImpl.java:205)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:161)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Transition.execute(Transition.java:212)
at org.springframework.webflow.engine.TransitionableState.onEvent(TransitionableState.java:107)
at org.springframework.webflow.engine.Flow.onEvent(Flow.java:534)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEvent(RequestControlContextImpl.java:205)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:161)
at org.springframework.webflow.engine.State.enter(State.java:191)
at org.springframework.webflow.engine.Flow.start(Flow.java:521)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.start(RequestControlContextImpl.java:193)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:177)
at org.springframework.webflow.executor.FlowExecutorImpl.launch(FlowExecutorImpl.java:187)
at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRequest(FlowRequestHandler.java:125)
at org.springframework.webflow.executor.mvc.FlowController.handleRequestInternal(FlowController.java:165)
at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:875)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:809)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:571)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:501)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:568)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:857)
at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:565)
at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1509)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor64.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at jcifs.spnego.Authentication.processKerberos(Authentication.java:430)
... 62 more
Caused by: java.security.PrivilegedActionException: java.lang.reflect.InvocationTargetException
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Unknown Source)
... 66 more
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor68.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517)
... 68 more
Caused by: GSSException: Channel binding mismatch (Mechanism level: ChannelBinding not provided!)
at sun.security.jgss.krb5.InitialToken$OverloadedChecksum.<init>(Unknown Source)
at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source)
at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)
at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
... 72 more
--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: I am getting this exception in production

2009-10-14T18:30:12Z

> 2009-10-06 10:36:32,582 ERROR [org.hibernate.transaction.JTATransaction] -
> JTA commit failed
> java.lang.IllegalStateException:
> [com.arjuna.ats.internal.jta.transaction.arjunacore.inactive]
> [com.arjuna.ats.internal.jta.transaction.arjunacore.inactive] The
> transaction is not active!

If I recall correctly, this can occur when the JDBC driver throws an
exception for a database error, e.g. constraint violation, and
subsequently rolls back the database transaction. Sometimes the
rollback isn't transmitted to the wrapping transaction manager, arjuna
in this case, and when the transaction manager tries to commit or roll
back its consituents, it fails because the underlying DB transaction
has been rolled back, and is therefore not active. You could help
confirm this by searching the logs for JDBC errors that are previous
to the one you shared; your database logs might also contain helpful
hints to support or refute this theory.

M

--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

I am getting this exception in production

2009-10-14T12:50:01Z

Why this exception makes transaction inactive.

Caused by: error.authentication.credentials.bad
        at org.jasig.cas.authentication.handler.BadCredentialsAuthenticationException.<clinit>(BadCredentialsAuthenticationException.java:25)
        at com.shc.ecom.sso.cas.web.authentication.AuthenticationManagerImpl.authenticate(AuthenticationManagerImpl.java:124)
        at org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTicket(CentralAuthenticationServiceImpl.java:417)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:585)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
        at $Proxy82.createTicketGrantingTicket(Unknown Source)
        at com.shc.ecom.sso.cas.web.flow.AuthenticationViaFormAction.submit(AuthenticationViaFormAction.java:128)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        ... 58 more
2009-10-06 10:36:32,582 ERROR [org.hibernate.transaction.JTATransaction] - JTA commit failed
java.lang.IllegalStateException: [com.arjuna.ats.internal.jta.transaction.arjunacore.inactive] [com.arjuna.ats.internal.jta.transaction.arjunacore.inactive] The transaction is not active!
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1372)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:135)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:87)
        at org.jboss.tm.usertx.client.ServerVMClientUserTransaction.commit(ServerVMClientUserTransaction.java:140)
        at org.hibernate.transaction.JTATransaction.commit(JTATransaction.java:146)
        at org.hibernate.ejb.TransactionImpl.commit(TransactionImpl.java:54)
        at org.springframework.orm.jpa.JpaTransactionManager.doCommit(JpaTransactionManager.java:456)
        at org.springframework.transaction.support.AbstractPlatformTransactionManager.processCommit(AbstractPlatformTransactionManager.java:709)
        at org.springframework.transaction.support.AbstractPlatformTransactionManager.commit(AbstractPlatformTransactionManager.java:678)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.commitTransactionAfterReturning(TransactionAspectSupport.java:321)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:116)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
        at $Proxy82.createTicketGrantingTicket(Unknown Source)
        at com.shc.ecom.sso.cas.web.flow.AuthenticationViaFormAction.submit(AuthenticationViaFormAction.java:128)
        at sun.reflect.GeneratedMethodAccessor235.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:585)
        at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethodInvoker.java:99)
        at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:133)
        at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:192)

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re:community call today

2009-10-14T11:00:49Z

I'l be like 2 minute late to the call.

On Wed, Oct 14, 2009 at 1:21 PM, Scott Battaglia <scott.battaglia@...> wrote:

Forgot to add the time. 2pm Eastern.

Apologies.

Cheers,
Scott

On Wed, Oct 14, 2009 at 12:26 PM, Scott Battaglia <scott.battaglia@...> wrote:

Just realized there is a community call today. No specific agenda but I can go over recent releases and upcoming releases.

We can use the normal call in number:
1-605-715-4920 755136#

Cheers,
Scott

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re:community call today

2009-10-14T10:21:44Z

Forgot to add the time. 2pm Eastern.

Apologies.

Cheers,

Scott

On Wed, Oct 14, 2009 at 12:26 PM, Scott Battaglia <scott.battaglia@...> wrote:

Just realized there is a community call today. No specific agenda but I can go over recent releases and upcoming releases.

We can use the normal call in number:
1-605-715-4920 755136#

Cheers,
Scott

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

community call today

2009-10-14T09:26:23Z

Just realized there is a community call today. No specific agenda but I can go over recent releases and upcoming releases.

We can use the normal call in number:
1-605-715-4920 755136#

Cheers,
Scott

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Modifications for returning ticket expiration time

2009-10-14T09:11:54Z

It all depends on the expiration policies you configure.

We have a number of them:
https://www.ja-sig.org/svn/cas3/trunk/cas-server-core/src/main/java/org/jasig/cas/ticket/support/

We have some documentation on them here also:
http://www.ja-sig.org/wiki/display/CASUM/Ticket+Expiration+Policy

Hope that helps.

Cheers,
Scott

On Wed, Oct 14, 2009 at 11:08 AM, Mark <mark.steddom@...> wrote:

Sorry to revisit this older topic,

I had the impression that the expiration time was not this static.
When a user authenticates into another service does it not extend the expiration for all PGTs previously issued?

For example:
If we have a two hour expiration configured...and
If a user logs into application A at 1:00 then the Authentication object (obtained from the Assertion) returns 1:00, The math can obviously be done to see that the credentials should be valid until 3:00 at which time the PGT that was requested and issued is no longer valid. Also meaning that proxy tickets can no longer be generated from that PGT.

But if the user logs into another CAS enabled application (new service string) at 2:00 then I was under the impression that the expiration would actually be extended until 4:00... even for the PGT generated for application A.

This would mean that application A could generate proxy tickets up until 4:00 now. Correct?
-----------------------------

If this is the case then is there some way to have application A determine or reevaluate how long it's PGT will be valid for?

Thanks for the clarification in advance,

--Mark

Mark Steddom
Northern Arizona University
--
You are currently subscribed to cas-dev@... as: scott.battaglia@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Its an Urgent one : sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

2009-10-14T08:15:59Z

I have my application on a Tomcat server instance and my CAS is setup on another Tomcat instance.
I am getting a certificate exception like the below. I followed certain instructions suggested by CAS articles to make my Tomcat SSL enabled.

But, it did not help me to get rid of the below exception. Can any one pls. help me ASAP on this one, it is pretty urgent for me.

javax.servlet.ServletException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:254)
edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:184)

root cause

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
edu.yale.its.tp.cas.util.SecureURL.retrieve(SecureURL.java:70)
edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(ServiceTicketValidator.java:212)
edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:219)
edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:184)

Re:Modifications for returning ticket expiration time

2009-10-14T08:08:41Z

Sorry to revisit this older topic,

I had the impression that the expiration time was not this static.
When a user authenticates into another service does it not extend the expiration for all PGTs previously issued?

For example:
If we have a two hour expiration configured...and
If a user logs into application A at 1:00 then the Authentication object (obtained from the Assertion) returns 1:00, The math can obviously be done to see that the credentials should be valid until 3:00 at which time the PGT that was requested and issued is no longer valid. Also meaning that proxy tickets can no longer be generated from that PGT.

But if the user logs into another CAS enabled application (new service string) at 2:00 then I was under the impression that the expiration would actually be extended until 4:00... even for the PGT generated for application A.

This would mean that application A could generate proxy tickets up until 4:00 now. Correct?
-----------------------------

If this is the case then is there some way to have application A determine or reevaluate how long it's PGT will be valid for?

Thanks for the clarification in advance,

--Mark

Mark Steddom
Northern Arizona University
--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Web Services authentication using CAS - How?

2009-10-13T00:56:02Z

Hi,

I have my Web Services and want to expose them to my Clients. I am evaluating CAS.

I described below what exactly I want.

I want CAS to authenticate my web services clients when they want to access my web services from their applications/portals whatever. How can I use CAS in this context.

I know how to configure and use CAS with simple Java/Servlets (but do not know how to use CAS with web services).

Can anyone help me? Also, please describe what are all the things that I need to consider when I configure CAS to do authentication for my Web Services.

Thanks,
Raja

LifeRay + CAS in a production environment

2009-10-09T02:48:51Z

Hi,

I am getting ready for a Liferay portal + CAS combination for my production environment.

Now, I have deployed in my local machine a sample application in a Tomcat server instance and I have deployed CAS Server (cas.war) in another Tomcat instance. Also, I have developed a custom Password handler in the CAS Server (cas.war).

I have taken care of CAS Filter configuration in my sample application's web.xml and all that, it is working fine.

Now, my requirement is that, I open a Httpsession in my custom password handler (which is in cas.war and its deployed in the first Tomcat server instance) and store some important info in the Httpsession. And I need to retrieve the same session and get the attributes in my sample application that runs in a different Tomcat instance than that of the CAS Server (cas.war).

I tried but it failed. i.e., it does NOT retrieve the session attributes in the sample application those were stored in the session by the above Custom password handler.

Can anyone please let me know, how do I share the session data between my custom Password handler and my sample application (which are running in 2 different Tomcat server instances)?

Re: CAS does NOT redirect to the application when the CAS is deployed in a different Tomcat instance!

2009-10-08T09:51:56Z

It most likely means you misconfigured your CAS client.

-Scott

On Thu, Oct 8, 2009 at 12:34 PM, nothingman <fabio.canepa@...> wrote:

Hi,
as explained in http://www.ja-sig.org/wiki/display/CASUM/Demo Cas Demo you
should avoid to use the name localhost inside you cas client configuration:
use the server name instead.
Also check the value of the parameter server name inside your sample webapp:
it should be something like http://youservername:8070/webapp

--
Fabio

RajaR wrote:
>
> Hi,
>
> I have CAS Server deployed in a Tomcat instance (https port 8443). And my
> sample application is deployed in a different Tomcat Instance (Port 8070)
> in my Machine (Windows).
>
> Now, when I access my sample application like the below,
>
> http://localhost:8070/webapp/sample/SampleServlet
>
> it redirects me to the CAS Login URL correctly (like below).
>
> https://localhost:8443/cas/login?service=http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet.
> Please note the URL, it appends a https URL for my Sample application
> which is wrong!
>
> In the CAS login page, I enter UserName/password and click Submit, then it
> forwards to the below URL which is wrong.
>
> https://localhost:8443/cas/login?service=http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet.
>
> In the above URL, please note that, the
> ?service = http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet
> which is https and with port 8443!.
>
> If it is http and port is 8070 it would have redicted to my Sample
> application correctly.
>
> Now, question is how do I fix this.
>
> When we have CAS and the application on the same Tomcat server instance
> this problem will NOT happen.
>
> Pls. help me.
>
>

--
View this message in context: http://www.nabble.com/CAS-does-NOT-redirect-to-the-application-when-the-CAS-is-deployed-in-a-different-Tomcat-instance%21-tp25803257p25803290.html
Sent from the CAS Dev mailing list archive at Nabble.com.

--
You are currently subscribed to cas-dev@... as: scott.battaglia@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: CAS does NOT redirect to the application when the CAS is deployed in a different Tomcat instance!

2009-10-08T09:34:30Z

Hi,
as explained in Cas Demo you should avoid to use the name localhost inside you cas client configuration: use the server name instead.
Also check the value of the parameter "serverName" inside your cas-client configuration: it should be something like http://youservername:8070/webapp

--
Fabio

RajaR wrote:

Hi,

I have CAS Server deployed in a Tomcat instance (https port 8443). And my sample application is deployed in a different Tomcat Instance (Port 8070) in my Machine (Windows).

Now, when I access my sample application like the below,

http://localhost:8070/webapp/sample/SampleServlet

it redirects me to the CAS Login URL correctly (like below).

https://localhost:8443/cas/login?service=http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet. Please note the URL, it appends a https URL for my Sample application which is wrong!

In the CAS login page, I enter UserName/password and click Submit, then it forwards to the below URL which is wrong.

https://localhost:8443/cas/login?service=http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet.

In the above URL, please note that, the
?service = http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet which is https and with port 8443!.

If it is http and port is 8070 it would have redicted to my Sample application correctly.

Now, question is how do I fix this.

When we have CAS and the application on the same Tomcat server instance this problem will NOT happen.

Pls. help me.

CAS does NOT redirect to the application when the CAS is deployed in a different Tomcat instance!

2009-10-08T08:32:13Z

Hi,

I have CAS Server deployed in a Tomcat instance (https port 8443). And my sample application is deployed in a different Tomcat Instance (Port 8070) in my Machine (Windows).

Now, when I access my sample application like the below,

http://localhost:8070/webapp/sample/SampleServlet

it redirects me to the CAS Login URL correctly (like below).

https://localhost:8443/cas/login?service=http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet. Please note the URL, it appends a https URL for my Sample application which is wrong!

In the CAS login page, I enter UserName/password and click Submit, then it forwards to the below URL which is wrong.

https://localhost:8443/cas/login?service=http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet.

In the above URL, please note that, the
?service = http%3A%2F%2Flocalhost%3A8443%2Fwebapp%2Fsample%2FSampleServlet which is https and with port 8443!.

If it is http and port is 8070 it would have redicted to my Sample application correctly.

Now, question is how do I fix this.

When we have CAS and the application on the same Tomcat server instance this problem will NOT happen.

Pls. help me.

OpeniD

2009-10-07T23:28:02Z

Hi Scott,

I have been senting several mails to the mailing list regarding the implemenation of OpeniD in CAS.

i read the wiki page in CAS,but need to understand how the sequence of actions are happned.

Could you provide more insight on this.

Regards

Hari

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Jasig Newsletter - Call for Content

2009-10-07T11:28:56Z

Hi Everyone,

The next edition of the monthly Jasig Newsletter will be published on
or about Wednesday, October 21st, 2009.

If your institution or company has items of interest to the Jasig
community, please submit them via email to newsletter at
jasig dot org by Tuesday, October 20th, 2009.

Many thanks,
Mark Rogers
Editor, Jasig Newsletter

--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Display error message from custom X509CredentialAuthenticationHandler in error box casLoginForm

2009-10-07T08:54:57Z

> i have implements my own AuthenticationHandler for X509Certs.
> ...
> Now, my X509CredentialAuthenticationHandler checks the X509Certs to a OCSP responder. This can get the status revoked or the certificate is not valid. This message i need to show the user in the GUI.
>
> The casLoginForm has an error div. What is to do, to show this Message into this error box?

http://www.nabble.com/Message-error-from-X509CredentialsAuthenticationHandler-td25609614.html
contains a similar question where I briefly outlined our solution. I
hope you find it helpful.

M

--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Display error message from custom X509CredentialAuthenticationHandler in error box casLoginForm

2009-10-07T06:50:43Z

Hello anybody,

i have implements my own AuthenticationHandler for X509Certs. This is working fine. I have configured the CAS 3.1.1 so that at first ist try to Authenticate with my X509CredentialAuthenticationHandler and if Authentication failed then try with the SimpleTestUsernamePasswordAuthenticationHandler (This is only for test).

Now, my X509CredentialAuthenticationHandler checks the X509Certs to a OCSP responder. This can get the status revoked or the certificate is not valid. This message i need to show the user in the GUI.

The casLoginForm has an error div. What is to do, to show this Message into this error box?

This error messages i can see only in my log-file to time.

Thanks for your time!

Gerd Kontze

--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Building cas server with m2eclipse

2009-10-06T23:47:09Z

Hi,
I've another problem and I cannot build cas-server-webapp with m2eclipse.

When I do a maven install from m2eclipse the error is:
[INFO] Scanning for projects...
[INFO] Attempting to resolve a version for plugin: org.apache.maven.plugins:maven-enforcer-plugin using meta-version: LATEST
[INFO] Using version: 1.0-beta-1 of plugin: org.apache.maven.plugins:maven-enforcer-plugin
[INFO] Attempting to resolve a version for plugin: org.apache.maven.plugins:maven-clover-plugin using meta-version: LATEST
[INFO] Using version: 2.4 of plugin: org.apache.maven.plugins:maven-clover-plugin
org.apache.maven.lifecycle.LifecycleSpecificationException:

No lifecycle phase binding can be found for goal: instrument,
specified as a part of the execution: defaultin plugin: org.apache.maven.plugins:maven-clover-plugin

This plugin was resolved successfully.
However, the mojo metadata it contains does not specify a default lifecycle phase binding.

Please provide a valid <phase/> specification for execution: default
in plugin: org.apache.maven.plugins:maven-clover-plugin

at org.apache.maven.lifecycle.binding.DefaultLifecycleBindingManager.getProjectCustomBindings(DefaultLifecycleBindingManager.java:266)
at org.apache.maven.lifecycle.plan.DefaultBuildPlanner.constructBuildPlan_aroundBody0(DefaultBuildPlanner.java:99)
at org.apache.maven.lifecycle.plan.DefaultBuildPlanner.constructBuildPlan_aroundBody1$advice(DefaultBuildPlanner.java:403)
at org.apache.maven.lifecycle.plan.DefaultBuildPlanner.constructBuildPlan(DefaultBuildPlanner.java:1)
at org.apache.maven.lifecycle.plan.DefaultBuildPlanner.constructInitialProjectBuildPlan(DefaultBuildPlanner.java:67)
at org.apache.maven.lifecycle.plan.DefaultBuildPlanner.constructInitialProjectBuildPlans(DefaultBuildPlanner.java:56)
at org.apache.maven.lifecycle.DefaultLifecycleExecutor.execute(DefaultLifecycleExecutor.java:138)
at org.apache.maven.DefaultMaven.execute_aroundBody0(DefaultMaven.java:223)
at org.apache.maven.DefaultMaven.execute_aroundBody1$advice(DefaultMaven.java:304)
at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:1)
at org.apache.maven.embedder.MavenEmbedder.execute_aroundBody2(MavenEmbedder.java:904)
at org.apache.maven.embedder.MavenEmbedder.execute_aroundBody3$advice(MavenEmbedder.java:304)
at org.apache.maven.embedder.MavenEmbedder.execute(MavenEmbedder.java:1)
at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:176)
at org.apache.maven.cli.MavenCli.main(MavenCli.java:63)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:408)
at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:351)
at org.codehaus.classworlds.Launcher.main(Launcher.java:31)
[ERROR]

Maven cannot calculate your build plan, given the following information:

Tasks:

Current project:
Group-Id: org.jasig.cas
Artifact-Id: cas-server-webapp
Version: 3.3.3
From file: /home/fabio/cas/local/cas-server-webapp/pom.xml

Error message:

No lifecycle phase binding can be found for goal: instrument,
specified as a part of the execution: defaultin plugin: org.apache.maven.plugins:maven-clover-plugin

This plugin was resolved successfully.
However, the mojo metadata it contains does not specify a default lifecycle phase binding.

Please provide a valid <phase/> specification for execution: default
in plugin: org.apache.maven.plugins:maven-clover-plugin

Root error message:

No lifecycle phase binding can be found for goal: instrument,
specified as a part of the execution: defaultin plugin: org.apache.maven.plugins:maven-clover-plugin

This plugin was resolved successfully.
However, the mojo metadata it contains does not specify a default lifecycle phase binding.

Please provide a valid <phase/> specification for execution: default
in plugin: org.apache.maven.plugins:maven-clover-plugin

[INFO] ------------------------------------------------------------------------
[INFO] For more information, run with the -e flag
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILED
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 2 seconds
[INFO] Finished at: Fri Oct 02 09:05:07 CEST 2009
[INFO] Final Memory: 6M/150M
[INFO] ------------------------------------------------------------------------

If I build cas-server-webapp with maven by command line every things works...

--
Fabio

mazzini wrote:

Hi All,

I try to build cas server 3.3.3 with m2eclipse plugin. When the war file is built an invalid version of spring-core and spring-beans libraries is used producing ClassNotFoundException at runtime.

How can i resolve this problem ?

(sorry for my english :) )

Fred

--
You are currently subscribed to cas-dev@lists.jasig.org as: lists@nabble.com
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

OpenID implemantion in CAS

2009-10-05T10:25:15Z

Hi,

Pleade provide how open iD flow working in CAS. Whats meant by the dump mode of open id protocol.

Need more details on the section given below for openid configuration specified in the CAS website.

Configuring your users to have URIs.

You'll need to set up a local mechanism for generating URIs for on their username (i.e. http://openid.rutgers.edu/battags).

The endpoint pages look something like this:

<html>
	<head>
		<link rel="openid.server" href="https://localhost/cas/login" />
	</head>
</html>

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Building cas server with m2eclipse

2009-10-03T20:30:24Z

Thanks. I'll probably apply it in the coming week.

Cheers,
Scott

On Fri, Oct 2, 2009 at 12:55 AM, Robert Winch <rwinch@...> wrote:

I created a JIRA issue and attached a patch based upon to http://www.ja-sig.org/issues/browse/CAS-802
On Thu, Oct 1, 2009 at 10:03 PM, Scott Battaglia <scott.battaglia@...> wrote:
Would you be able to attach a diff to a JIRA issue for me to apply to the project?

Thanks!
Scott
On Thu, Oct 1, 2009 at 7:13 PM, Robert Winch <rwinch@...> wrote:
I too have seen this problem and am embarrassed to say that I silently fixed it locally and did not contribute back (hopefully I can rectify my wrong).

Maven2 "Dependency mediation" specifies that the version that is resolved is the "nearest definition" [1]. With that said, if you explicitly list spring-core-2.5.6.jar that will be the version that is resolved. This is the safest approach when a specific version of a jar is required.

The latest version of the m2eclipse plugin uses Maven 3 which is suppose to be compatible (except internal APIs) with Maven 2. I think the discrepancy is in how the shortest path is defined when a parent and child exist. I'm not sure which is the desired behavior, but asked on the maven mailing list [2]. The m2eclipse plugin treats parent dependencies as closer and Maven 2 thinks child dependencies are closer. For example, below is a very simplified list of dependencies that simulates the issue [3]. Both spring-webflow and spring-aop have direct dependencies on spring-core. The m2eclipse plugin thinks that the spring-core-2.0.7.jar found as a direct dependency of spring-webflow (found in the parent) is the "nearest definition". On the other hand maven2 seems to think that spring-core-2.5.6.jar found as a direct dependency of spring-aop (found in the child) is the "nearest definition". If you change the example below to have spring-webflow to be the first dependency directly in the child both m2eclipse and maven2 agree that spring-core-2.0.7 should be resolved. If you move spring-aop to be the second dependency in the parent the version of spring is consistent too.

Regards,
Rob

[1] http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Transitive_Dependencies

[2] http://www.nabble.com/Transitive-Dependencies%3A-Is-the-parent-or-child-dependency-the--%22nearest-dependency%22--td25708104.html

[3]

parent

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>parent</groupId>
    <artifactId>parent</artifactId>
    <packaging>pom</packaging>
    <version>1.0-SNAPSHOT</version>
    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webflow</artifactId>
            <version>1.0.6</version>
        </dependency>
    </dependencies>
</project>

child

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>parent</artifactId>
        <groupId>parent</groupId>
        <version>1.0-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>child</groupId>
    <artifactId>child</artifactId>
    <packaging>war</packaging>
    <version>1.0-SNAPSHOT</version>

    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>2.5.6</version>
        </dependency>
    </dependencies>
</project>
On Thu, Oct 1, 2009 at 1:02 PM, Howard Gilbert <Howard.Gilbert@...> wrote:
The problem is triggered because (at least) the spring-webflow-1.0.6.pom calls up as a dependency (among others)

                                <dependency>

                                                <groupId>org.springframework</groupId>

                                                <artifactId>spring-core</artifactId>

                                                <version>2.0.7</version>

                                </dependency>

That is, while all elements of the SpringFramework proper tend to lock step from release to release, the independent Spring components like webflow that have their own release numbers depend on whatever they regard as the lowest allowable version of the Framework proper. Unfortunately, the m2eclipse (but apparently not Maven itself) regards this literally and adds an additional requirement for 2.0.7 as well as the current 2.5.6.

This appears to be a bug in m2eclipse. There is no plausible reason why any valid Maven technology would use two different versions of the same artifact name. There seems, however, to be some local (to the subproject) and global disconnect in the dependency resolution that generates both of them.

If there is some Maven syntax that will knock m2eclipse hard on the head and make it realize the problem and fix it automatically, then it would be great to fix it properly. If not, then the nasty solution I have tested is to edit :

$HOME/.m2/repository/org/springframework/spring-x/1.0.y/spring-x-1.0.y.pom

Where x is either “webflow” or “bindings” and y is either “5” or “6”.

In these POM files delete the <version>2.0.7</version> line in all spring-xxx artifact dependencies. In think there is one incorrect $Project version dependency as well and I got rid of it too.

Then you rebuild the m2eclipse Maven dependencies by selecting the project, Disable Dependency Mangement, Enable Dependency Management, and Enable Nested Modules.

[Disclaimer: following these instructions may destroy the known universe. I cannot be responsible for results. Use only on a test project/reponsitory/machine or if you are prepared to deal with anything that goes wrong.]

Or we could wait for m2eclipse to fix this, but it is already somewhat magic that it works as well as it does and I am not sure how easy it will be for them to deal with this problem.

From: Scott Battaglia [mailto:scott.battaglia@...]
Sent: Thursday, October 01, 2009 12:26 PM
To: cas-dev@...
Subject: Re: [cas-dev] Building cas server with m2eclipse

Howard, if you know what Poms hey came from I can add explicit exclusions for 3.3.5 I can also see if the dependency tree plugin will tell me if you're not sure.
-- 
You are currently subscribed to cas-dev@... as: rwinch@...


To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
-- 
You are currently subscribed to cas-dev@... as: scott.battaglia@...





To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
-- 
You are currently subscribed to cas-dev@... as: rwinch@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
-- 
You are currently subscribed to cas-dev@... as: scott.battaglia@...


To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Exception in Quartz Job when running Load test

2009-10-02T13:37:36Z

> We are running a loadtesting for CAS with 4 JBOSS servers. When user load is
> increased to 400 we are getting an exception as below.

The exception you mentioned has been documented pretty thoroughly in
http://www.ja-sig.org/issues/browse/CAS-782. Note that we have
observed that deadlocks dramatically decrease if not disappear when
the indices on the foreign keys are created as described in the issue.

> The quartz job is running from all locations.
> What is the best option to run quartz job in this scenario.
> Only enabling Quartz job in one of the servers only?

There are two recommended solutions at present:
1. Run the Quartz job on only one node.
2. Handle ticket cleanup on the database side.

I would argue both solutions have significant downsides. The first
option is bad for a high availability environment. The second is bad
since it's not possible to determine the exact ticket state from the
data in the ticket tables.

I have developed an alternative ticket cleaner implementation that I
am planning to attach to a Jira issue in the next week that allows the
Quartz job to be deployed to all nodes but only one node at a time can
execute. This is the ideal solution in my opinion. We expect
deadlocks to disappear entirely once this goes into production.

M

--
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Exception in Quartz Job when running Load test

2009-10-02T13:29:56Z

Hi ,

We are running a loadtesting for CAS with 4 JBOSS servers. When user load is increased to 400 we are getting an exception as below.

The quartz job is running from all locations.

What is the best option to run quartz job in this scenario.

Only enabling Quartz job in one of the servers only?

2009-10-02 05:21:23,404 INFO [STDOUT] 2009-10-02 05:21:23,404 ERROR [org.hibernate.util.JDBCExceptionReporter] - <Lock wait timeout exceeded; try restarting transaction>

2009-10-02 05:21:23,414 INFO [STDOUT] 2009-10-02 05:21:23,409 ERROR [org.hibernate.event.def.AbstractFlushingEventListener] - <Could not synchronize database state with session>

org.hibernate.exception.GenericJDBCException: Could not execute JDBC batch update

at org.hibernate.exception.SQLStateConverter.handledNonSpecificException(SQLStateConverter.java:103)

at org.hibernate.exception.SQLStateConverter.convert(SQLStateConverter.java:91)

at org.hibernate.exception.JDBCExceptionHelper.convert(JDBCExceptionHelper.java:43)

at org.hibernate.jdbc.AbstractBatcher.executeBatch(AbstractBatcher.java:253)

at org.hibernate.engine.ActionQueue.executeActions(ActionQueue.java:237)

at org.hibernate.engine.ActionQueue.executeActions(ActionQueue.java:146)

at org.hibernate.event.def.AbstractFlushingEventListener.performExecutions(AbstractFlushingEventListener.java:298)

at org.hibernate.event.def.DefaultFlushEventListener.onFlush(DefaultFlushEventListener.java:27)

at org.hibernate.impl.SessionImpl.flush(SessionImpl.java:1000)

at org.hibernate.impl.SessionImpl.managedFlush(SessionImpl.java:338)

at org.hibernate.transaction.JTATransaction.commit(JTATransaction.java:135)

at org.hibernate.ejb.TransactionImpl.commit(TransactionImpl.java:54)

at org.springframework.orm.jpa.JpaTransactionManager.doCommit(JpaTransactionManager.java:456)

at org.springframework.transaction.support.AbstractPlatformTransactionManager.processCommit(AbstractPlatformTransactionManager.java:709)

at org.springframework.transaction.support.AbstractPlatformTransactionManager.commit(AbstractPlatformTransactionManager.java:678)

at org.springframework.transaction.interceptor.TransactionAspectSupport.commitTransactionAfterReturning(TransactionAspectSupport.java:321)

at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:116)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

at $Proxy80.deleteTicket(Unknown Source)

at org.jasig.cas.ticket.registry.support.DefaultTicketRegistryCleaner.clean(DefaultTicketRegistryCleaner.java:72)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:585)

at org.springframework.util.MethodInvoker.invoke(MethodInvoker.java:276)

at org.springframework.scheduling.quartz.MethodInvokingJobDetailFactoryBean$MethodInvokingJob.executeInternal(MethodInvokingJobDetailFactoryBean.java:260)

at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86)

at org.quartz.core.JobRunShell.run(JobRunShell.java:203)

at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:520)

Caused by: java.sql.BatchUpdateException: Lock wait timeout exceeded; try restarting transaction

at com.mysql.jdbc.PreparedStatement.executeBatchSerially(PreparedStatement.java:1269)

at com.mysql.jdbc.PreparedStatement.executeBatch(PreparedStatement.java:955)

at org.jboss.resource.adapter.jdbc.WrappedStatement.executeBatch(WrappedStatement.java:519)

at org.hibernate.jdbc.BatchingBatcher.doExecuteBatch(BatchingBatcher.java:48)

at org.hibernate.jdbc.AbstractBatcher.executeBatch(AbstractBatcher.java:246)

... 26 more

2009-10-02 05:21:23,417 INFO [STDOUT] 2009-10-02 05:21:23,416 ERROR [org.quartz.core.JobRunShell] - <Job DEFAULT.jobDetailTicketRegistryCleaner threw an unhandled Exception: >

org.springframework.scheduling.quartz.JobMethodInvocationFailedException: Invocation of method 'clean' on target class [class org.jasig.cas.ticket.registry.support.DefaultTicketRegistryCleaner] failed; neste

d exception is org.springframework.transaction.TransactionSystemException: Could not commit JPA transaction; nested exception is javax.persistence.RollbackException: Error while commiting the transaction

at org.springframework.scheduling.quartz.MethodInvokingJobDetailFactoryBean$MethodInvokingJob.executeInternal(MethodInvokingJobDetailFactoryBean.java:269)

at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86)

at org.quartz.core.JobRunShell.run(JobRunShell.java:203)

at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:520)

Caused by: org.springframework.transaction.TransactionSystemException: Could not commit JPA transaction; nested exception is javax.persistence.RollbackException: Error while commiting the transaction

at org.springframework.orm.jpa.JpaTransactionManager.doCommit(JpaTransactionManager.java:465)

at org.springframework.transaction.support.AbstractPlatformTransactionManager.processCommit(AbstractPlatformTransactionManager.java:709)

at org.springframework.transaction.support.AbstractPlatformTransactionManager.commit(AbstractPlatformTransactionManager.java:678)

at org.springframework.transaction.interceptor.TransactionAspectSupport.commitTransactionAfterReturning(TransactionAspectSupport.java:321)

at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:116)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Building cas server with m2eclipse

2009-10-01T21:55:49Z

I created a JIRA issue and attached a patch based upon to http://www.ja-sig.org/issues/browse/CAS-802

On Thu, Oct 1, 2009 at 10:03 PM, Scott Battaglia <scott.battaglia@...> wrote:

Would you be able to attach a diff to a JIRA issue for me to apply to the project?

Thanks!
Scott
On Thu, Oct 1, 2009 at 7:13 PM, Robert Winch <rwinch@...> wrote:
I too have seen this problem and am embarrassed to say that I silently fixed it locally and did not contribute back (hopefully I can rectify my wrong).

Maven2 "Dependency mediation" specifies that the version that is resolved is the "nearest definition" [1]. With that said, if you explicitly list spring-core-2.5.6.jar that will be the version that is resolved. This is the safest approach when a specific version of a jar is required.

The latest version of the m2eclipse plugin uses Maven 3 which is suppose to be compatible (except internal APIs) with Maven 2. I think the discrepancy is in how the shortest path is defined when a parent and child exist. I'm not sure which is the desired behavior, but asked on the maven mailing list [2]. The m2eclipse plugin treats parent dependencies as closer and Maven 2 thinks child dependencies are closer. For example, below is a very simplified list of dependencies that simulates the issue [3]. Both spring-webflow and spring-aop have direct dependencies on spring-core. The m2eclipse plugin thinks that the spring-core-2.0.7.jar found as a direct dependency of spring-webflow (found in the parent) is the "nearest definition". On the other hand maven2 seems to think that spring-core-2.5.6.jar found as a direct dependency of spring-aop (found in the child) is the "nearest definition". If you change the example below to have spring-webflow to be the first dependency directly in the child both m2eclipse and maven2 agree that spring-core-2.0.7 should be resolved. If you move spring-aop to be the second dependency in the parent the version of spring is consistent too.

Regards,
Rob

[1] http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Transitive_Dependencies

[2] http://www.nabble.com/Transitive-Dependencies%3A-Is-the-parent-or-child-dependency-the--%22nearest-dependency%22--td25708104.html

[3]

parent

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>parent</groupId>
    <artifactId>parent</artifactId>
    <packaging>pom</packaging>
    <version>1.0-SNAPSHOT</version>
    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webflow</artifactId>
            <version>1.0.6</version>
        </dependency>
    </dependencies>
</project>

child

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>parent</artifactId>
        <groupId>parent</groupId>
        <version>1.0-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>child</groupId>
    <artifactId>child</artifactId>
    <packaging>war</packaging>
    <version>1.0-SNAPSHOT</version>

    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>2.5.6</version>
        </dependency>
    </dependencies>
</project>
On Thu, Oct 1, 2009 at 1:02 PM, Howard Gilbert <Howard.Gilbert@...> wrote:
The problem is triggered because (at least) the spring-webflow-1.0.6.pom calls up as a dependency (among others)

                                <dependency>

                                                <groupId>org.springframework</groupId>

                                                <artifactId>spring-core</artifactId>

                                                <version>2.0.7</version>

                                </dependency>

That is, while all elements of the SpringFramework proper tend to lock step from release to release, the independent Spring components like webflow that have their own release numbers depend on whatever they regard as the lowest allowable version of the Framework proper. Unfortunately, the m2eclipse (but apparently not Maven itself) regards this literally and adds an additional requirement for 2.0.7 as well as the current 2.5.6.

This appears to be a bug in m2eclipse. There is no plausible reason why any valid Maven technology would use two different versions of the same artifact name. There seems, however, to be some local (to the subproject) and global disconnect in the dependency resolution that generates both of them.

If there is some Maven syntax that will knock m2eclipse hard on the head and make it realize the problem and fix it automatically, then it would be great to fix it properly. If not, then the nasty solution I have tested is to edit :

$HOME/.m2/repository/org/springframework/spring-x/1.0.y/spring-x-1.0.y.pom

Where x is either “webflow” or “bindings” and y is either “5” or “6”.

In these POM files delete the <version>2.0.7</version> line in all spring-xxx artifact dependencies. In think there is one incorrect $Project version dependency as well and I got rid of it too.

Then you rebuild the m2eclipse Maven dependencies by selecting the project, Disable Dependency Mangement, Enable Dependency Management, and Enable Nested Modules.

[Disclaimer: following these instructions may destroy the known universe. I cannot be responsible for results. Use only on a test project/reponsitory/machine or if you are prepared to deal with anything that goes wrong.]

Or we could wait for m2eclipse to fix this, but it is already somewhat magic that it works as well as it does and I am not sure how easy it will be for them to deal with this problem.

From: Scott Battaglia [mailto:scott.battaglia@...]
Sent: Thursday, October 01, 2009 12:26 PM
To: cas-dev@...
Subject: Re: [cas-dev] Building cas server with m2eclipse

Howard, if you know what Poms hey came from I can add explicit exclusions for 3.3.5 I can also see if the dependency tree plugin will tell me if you're not sure.
-- 
You are currently subscribed to cas-dev@... as: rwinch@...


To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
-- 
You are currently subscribed to cas-dev@... as: scott.battaglia@...



To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
-- 
You are currently subscribed to cas-dev@... as: rwinch@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Building cas server with m2eclipse

2009-10-01T20:03:05Z

Would you be able to attach a diff to a JIRA issue for me to apply to the project?

Thanks!
Scott

On Thu, Oct 1, 2009 at 7:13 PM, Robert Winch <rwinch@...> wrote:

I too have seen this problem and am embarrassed to say that I silently fixed it locally and did not contribute back (hopefully I can rectify my wrong).

Maven2 "Dependency mediation" specifies that the version that is resolved is the "nearest definition" [1]. With that said, if you explicitly list spring-core-2.5.6.jar that will be the version that is resolved. This is the safest approach when a specific version of a jar is required.

The latest version of the m2eclipse plugin uses Maven 3 which is suppose to be compatible (except internal APIs) with Maven 2. I think the discrepancy is in how the shortest path is defined when a parent and child exist. I'm not sure which is the desired behavior, but asked on the maven mailing list [2]. The m2eclipse plugin treats parent dependencies as closer and Maven 2 thinks child dependencies are closer. For example, below is a very simplified list of dependencies that simulates the issue [3]. Both spring-webflow and spring-aop have direct dependencies on spring-core. The m2eclipse plugin thinks that the spring-core-2.0.7.jar found as a direct dependency of spring-webflow (found in the parent) is the "nearest definition". On the other hand maven2 seems to think that spring-core-2.5.6.jar found as a direct dependency of spring-aop (found in the child) is the "nearest definition". If you change the example below to have spring-webflow to be the first dependency directly in the child both m2eclipse and maven2 agree that spring-core-2.0.7 should be resolved. If you move spring-aop to be the second dependency in the parent the version of spring is consistent too.

Regards,
Rob

[1] http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Transitive_Dependencies

[2] http://www.nabble.com/Transitive-Dependencies%3A-Is-the-parent-or-child-dependency-the--%22nearest-dependency%22--td25708104.html

[3]

parent

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>parent</groupId>
    <artifactId>parent</artifactId>
    <packaging>pom</packaging>
    <version>1.0-SNAPSHOT</version>
    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webflow</artifactId>
            <version>1.0.6</version>
        </dependency>
    </dependencies>
</project>

child

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>parent</artifactId>
        <groupId>parent</groupId>
        <version>1.0-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>child</groupId>
    <artifactId>child</artifactId>
    <packaging>war</packaging>
    <version>1.0-SNAPSHOT</version>

    <dependencies>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>2.5.6</version>
        </dependency>
    </dependencies>
</project>
On Thu, Oct 1, 2009 at 1:02 PM, Howard Gilbert <Howard.Gilbert@...> wrote:
The problem is triggered because (at least) the spring-webflow-1.0.6.pom calls up as a dependency (among others)

                                <dependency>

                                                <groupId>org.springframework</groupId>

                                                <artifactId>spring-core</artifactId>

                                                <version>2.0.7</version>

                                </dependency>

That is, while all elements of the SpringFramework proper tend to lock step from release to release, the independent Spring components like webflow that have their own release numbers depend on whatever they regard as the lowest allowable version of the Framework proper. Unfortunately, the m2eclipse (but apparently not Maven itself) regards this literally and adds an additional requirement for 2.0.7 as well as the current 2.5.6.

This appears to be a bug in m2eclipse. There is no plausible reason why any valid Maven technology would use two different versions of the same artifact name. There seems, however, to be some local (to the subproject) and global disconnect in the dependency resolution that generates both of them.

If there is some Maven syntax that will knock m2eclipse hard on the head and make it realize the problem and fix it automatically, then it would be great to fix it properly. If not, then the nasty solution I have tested is to edit :

$HOME/.m2/repository/org/springframework/spring-x/1.0.y/spring-x-1.0.y.pom

Where x is either “webflow” or “bindings” and y is either “5” or “6”.

In these POM files delete the <version>2.0.7</version> line in all spring-xxx artifact dependencies. In think there is one incorrect $Project version dependency as well and I got rid of it too.

Then you rebuild the m2eclipse Maven dependencies by selecting the project, Disable Dependency Mangement, Enable Dependency Management, and Enable Nested Modules.

[Disclaimer: following these instructions may destroy the known universe. I cannot be responsible for results. Use only on a test project/reponsitory/machine or if you are prepared to deal with anything that goes wrong.]

Or we could wait for m2eclipse to fix this, but it is already somewhat magic that it works as well as it does and I am not sure how easy it will be for them to deal with this problem.

From: Scott Battaglia [mailto:scott.battaglia@...]
Sent: Thursday, October 01, 2009 12:26 PM
To: cas-dev@...
Subject: Re: [cas-dev] Building cas server with m2eclipse

Howard, if you know what Poms hey came from I can add explicit exclusions for 3.3.5 I can also see if the dependency tree plugin will tell me if you're not sure.
-- 
You are currently subscribed to cas-dev@... as: rwinch@...


To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
-- 
You are currently subscribed to cas-dev@... as: scott.battaglia@...


To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Re: Building cas server with m2eclipse

2009-10-01T16:13:24Z

I too have seen this problem and am embarrassed to say that I silently fixed it locally and did not contribute back (hopefully I can rectify my wrong).

Maven2 "Dependency mediation" specifies that the version that is resolved is the "nearest definition" [1]. With that said, if you explicitly list spring-core-2.5.6.jar that will be the version that is resolved. This is the safest approach when a specific version of a jar is required.

The latest version of the m2eclipse plugin uses Maven 3 which is suppose to be compatible (except internal APIs) with Maven 2. I think the discrepancy is in how the shortest path is defined when a parent and child exist. I'm not sure which is the desired behavior, but asked on the maven mailing list [2]. The m2eclipse plugin treats parent dependencies as closer and Maven 2 thinks child dependencies are closer. For example, below is a very simplified list of dependencies that simulates the issue [3]. Both spring-webflow and spring-aop have direct dependencies on spring-core. The m2eclipse plugin thinks that the spring-core-2.0.7.jar found as a direct dependency of spring-webflow (found in the parent) is the "nearest definition". On the other hand maven2 seems to think that spring-core-2.5.6.jar found as a direct dependency of spring-aop (found in the child) is the "nearest definition". If you change the example below to have spring-webflow to be the first dependency directly in the child both m2eclipse and maven2 agree that spring-core-2.0.7 should be resolved. If you move spring-aop to be the second dependency in the parent the version of spring is consistent too.

Regards,
Rob

[1] http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Transitive_Dependencies

[2] http://www.nabble.com/Transitive-Dependencies%3A-Is-the-parent-or-child-dependency-the--%22nearest-dependency%22--td25708104.html

[3]

parent

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>parent</groupId>
    <artifactId>parent</artifactId>
    <packaging>pom</packaging>
    <version>1.0-SNAPSHOT</version>
    <dependencies>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webflow</artifactId>
            <version>1.0.6</version>
        </dependency>
    </dependencies>
</project>

child

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>parent</artifactId>
        <groupId>parent</groupId>
        <version>1.0-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>child</groupId>
    <artifactId>child</artifactId>
    <packaging>war</packaging>
    <version>1.0-SNAPSHOT</version>

    <dependencies>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>2.5.6</version>
        </dependency>
    </dependencies>
</project>

On Thu, Oct 1, 2009 at 1:02 PM, Howard Gilbert <Howard.Gilbert@...> wrote:

The problem is triggered because (at least) the spring-webflow-1.0.6.pom calls up as a dependency (among others)

                                <dependency>

                                                <groupId>org.springframework</groupId>

                                                <artifactId>spring-core</artifactId>

                                                <version>2.0.7</version>

                                </dependency>

That is, while all elements of the SpringFramework proper tend to lock step from release to release, the independent Spring components like webflow that have their own release numbers depend on whatever they regard as the lowest allowable version of the Framework proper. Unfortunately, the m2eclipse (but apparently not Maven itself) regards this literally and adds an additional requirement for 2.0.7 as well as the current 2.5.6.

This appears to be a bug in m2eclipse. There is no plausible reason why any valid Maven technology would use two different versions of the same artifact name. There seems, however, to be some local (to the subproject) and global disconnect in the dependency resolution that generates both of them.

If there is some Maven syntax that will knock m2eclipse hard on the head and make it realize the problem and fix it automatically, then it would be great to fix it properly. If not, then the nasty solution I have tested is to edit :

$HOME/.m2/repository/org/springframework/spring-x/1.0.y/spring-x-1.0.y.pom

Where x is either “webflow” or “bindings” and y is either “5” or “6”.

In these POM files delete the <version>2.0.7</version> line in all spring-xxx artifact dependencies. In think there is one incorrect $Project version dependency as well and I got rid of it too.

Then you rebuild the m2eclipse Maven dependencies by selecting the project, Disable Dependency Mangement, Enable Dependency Management, and Enable Nested Modules.

[Disclaimer: following these instructions may destroy the known universe. I cannot be responsible for results. Use only on a test project/reponsitory/machine or if you are prepared to deal with anything that goes wrong.]

Or we could wait for m2eclipse to fix this, but it is already somewhat magic that it works as well as it does and I am not sure how easy it will be for them to deal with this problem.

From: Scott Battaglia [mailto:scott.battaglia@...]
Sent: Thursday, October 01, 2009 12:26 PM
To: cas-dev@...
Subject: Re: [cas-dev] Building cas server with m2eclipse

Howard, if you know what Poms hey came from I can add explicit exclusions for 3.3.5 I can also see if the dependency tree plugin will tell me if you're not sure.
-- 
You are currently subscribed to cas-dev@... as: rwinch@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

-- 
You are currently subscribed to cas-dev@... as: lists@...
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev

Nabble - CAS Dev

Re: Integrating a SAML 2.0 IdP with CAS

Re: Integrating a SAML 2.0 IdP with CAS

Integrating a SAML 2.0 IdP with CAS

How to use Verisign certicate in Tomcat (for SSL) and WITHOUT a .keystore file

Re:JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

Re: JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

Re:JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

Re: JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

JCIFSSpnegoAuthenticationHandler stops working when instaling patch KB974455 in Internet Explorer

Re: I am getting this exception in production

I am getting this exception in production

Re:community call today

Re:community call today

More description of my Problem - Re: Its an Urgent one : sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

community call today

Re: Modifications for returning ticket expiration time

Its an Urgent one : sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Re:Modifications for returning ticket expiration time

Web Services authentication using CAS - How?

LifeRay + CAS in a production environment

Re: CAS does NOT redirect to the application when the CAS is deployed in a different Tomcat instance!

Re: CAS does NOT redirect to the application when the CAS is deployed in a different Tomcat instance!

CAS does NOT redirect to the application when the CAS is deployed in a different Tomcat instance!

OpeniD

Jasig Newsletter - Call for Content

Re: Display error message from custom X509CredentialAuthenticationHandler in error box casLoginForm

Display error message from custom X509CredentialAuthenticationHandler in error box casLoginForm

Re: Building cas server with m2eclipse

OpenID implemantion in CAS

Hi,

Configuring your users to have URIs.

Re: Building cas server with m2eclipse

Re: Exception in Quartz Job when running Load test

Exception in Quartz Job when running Load test

Re: Building cas server with m2eclipse

Re: Building cas server with m2eclipse

Re: Building cas server with m2eclipse