Jasig CAS + Beehive (third party SSO)

Question

Hello,
We are currently evaluating Beehive and one of the requirements we have is to integrate it with a third party SSO provider (Jasig CAS). I have followed the steps defined in the Oracle Beehive Pluggable Authentication http://www.oracle.com/technetwork/middleware/beehive/plugauth-096705.html#compiling_and_packaging_plug-in and managed to get the sample sso identity plugin "working" (its working enough to redirect me to a login page).
Now the question that I have (i hope you can provide some guidance) is that in order for me to integrate it with the "CAS Client", i need to add some filters to web.xml but everytime I do that, and I restart beehive, the BEECLIENT doesnt start.
I don't know if its because I am missing a .jar (I copied the CAS .jar's to $ORACLE_HOME/j2ee/lib/ext) or if there is something I can enable (DEBUG MODE) on beehive which can help me troubleshoot the issue. Is adding additional filters in web.xml possible?
This is more or less what I wanted to add (note , i tried this in the following file: $ORACLE_HOME/j2ee/BEECLIENT/applications/teamcollaboration/teamcollaboration/WEB-INF/web.xml)
<filter>
          <filter-name>CAS Authentication Filter</filter-name>
          <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
          <init-param>
               <param-name>casServerLoginUrl</param-name>
               <param-value>https://login.server.com/cas/login</param-value>
          </init-param>
          <init-param>
               <param-name>serverName</param-name>
               <param-value>https://beehive.server.com</param-value>
          </init-param>
          <init-param>
               <param-name>renew</param-name>
               <param-value>false</param-value>
          </init-param>
          <init-param>
               <param-name>gateway</param-name>
               <param-value>false</param-value>
          </init-param>
     </filter>
     <filter>
          <filter-name>CAS Validation Filter</filter-name>
          <filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
          <init-param>
               <param-name>casServerUrlPrefix</param-name>
               <param-value>https://login.server.com/cas/</param-value>
          </init-param>
          <init-param>
               <param-name>serverName</param-name>
               <param-value>https://beehive.server.com</param-value>
          </init-param>
          <init-param>
               <param-name>proxyCallbackUrl</param-name>
               <param-value>https://beehive.server.com/proxyCallback</param-value>
          </init-param>
          <init-param>
               <param-name>proxyReceptorUrl</param-name>
               <param-value>/proxyCallback</param-value>
          </init-param>
     </filter>
     <filter>
          <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
          <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
     </filter>
     <filter>
          <filter-name>CAS Assertion Thread Local Filter</filter-name>
          <filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
     </filter>
     <!-- ************************* -->
<!-- Sign out not yet implemented -->
<!--
     <filter-mapping>
          <filter-name>CAS Single Sign Out Filter</filter-name>
          <url-pattern>/*</url-pattern>
     </filter-mapping>
-->
     <filter-mapping>
          <filter-name>CAS Authentication Filter</filter-name>
          <url-pattern>/protected/*</url-pattern>
     </filter-mapping>
     <filter-mapping>
          <filter-name>CAS Validation Filter</filter-name>
          <url-pattern>/*</url-pattern>
     </filter-mapping>
     <filter-mapping>
          <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
          <url-pattern>/*</url-pattern>
     </filter-mapping>
     <filter-mapping>
          <filter-name>CAS Assertion Thread Local Filter</filter-name>
          <url-pattern>/*</url-pattern>
     </filter-mapping>
     <filter-mapping>
          <filter-name>CAS Validation Filter</filter-name>
          <url-pattern>/proxyCallback</url-pattern>     
     </filter-mapping>
Thanks in advance!

Answer 1

Richard,
Thanks for the reply. Let me expand of what I am trying to accomplish:
1. User goes to https://beehive.server.com/teamcollab
2. The Beehive PAM plugin kicks in and the user gets redirected to https://cas.server.com/cas/login/?service=https://beehive.server.com/teamcollab
3. Once the cas.server.com authenticates the user, it redirects the browser back to https://beehive.server.com/teamcollab/?*ticket=RANDOM_NUMBERS*
At the very least, I need to be able to readthe "ticket" parameter and validate the RANDOM_NUMBERS against cas.server.com so that I can get the username (no cookie involved here) back from the CAS server.
This is the code I was trying:
public String getIdentity(HttpServletRequest req, Map<String, String> props) throws IdentityException {
String ticket = req.getParameter("ticket");
          AttributePrincipal principal = null;
          String casServerUrl = "https://cas.server.com/cas";
          if(ticket == null || "".equals(ticket))
               throw new IdentityException("Service Ticket is Null or empty", null);
          Cas20ProxyTicketValidator sv = new Cas20ProxyTicketValidator(casServerUrl);
          sv.setAcceptAnyProxy(true);
          try {
               String legacyServerServiceUrl = "https://beehive.server.com/teamcollab";
               Assertion a = sv.validate(ticket, legacyServerServiceUrl);
               principal = a.getPrincipal();
          } catch (TicketValidationException e) {
               e.printStackTrace(); // bad style, but only for demonstration purpose.
          String authuser = principal.getName();
          if(authuser == null)
               throw new IdentityException("User is null", null);
          return authuser;
But when I tried that, my browser (frefox) detected an invalid redirect and nothing worked. I don't know how to troubleshoot this piece of code (do you know how to increase debug level and or dump vairiables to a log file, and if so which log file its going?)
Since I got the "invalid redirect" from firefox, i tried adding the cas filters (to web.xml) which in essence should allow me to just do something like String username = request.getRemoteUser(); and that is when beehive crashed.
So based on your response, I should stay away from changing web.xml (good because I didn't want to modify it to begin with) but do you have any recommendation as to how to debug the code ? I would like to echo something like "Service Ticket Received is: blah blah blah" to $ORACLE_HOME/beehive/logs/oc4j/BEECLIENT/log.txt or a similar log
Thanks for your help.