We have a new install of ArcGIS Portal running with the WebAdaptor using IIS. If we login directly, it works just fine. However, we have a mandate to use a CAS login process, and when we enable that, we end up with a redirect loop upon login.
What definitely happens is that, when you go to the main page, it does redirect to the CAS server, and then redirects back to the home page. However, it seems to not find the cookie with the CAS-generated token there, and redirects back to the signin page. The signin page finds it in the session, I guess (at least, it definitely doesn't go back to the CAS server), and redirects back to the home page, and the loop continues until the browser calls a stop to it.
The CAS client is the DotNetCasClient, and its configuration in the Web.config for the WebAdaptor app has:
<configuration> <configSections> <section name="casClientConfig" type="DotNetCasClient.Configuration.CasClientConfiguration, DotNotCasClient" /> </configSections> <casClientConfig casServerLoginUrl="https://loginHost/cas/login" casServerUrlPrefix="https://loginHost/cas" serverName="https://portalServer" redirectAfterValidation="true" gateway="false" renew="false" singleSignOut="false" ticketValidatorName="Cas10" /> ... <system.web> ... <authentication mode="Forms"> <forms cookieless="UseCookies" domain="our-domain" <!-- CAS and portal are both in same domain --> loginUrl="https://loginServer/cas/login" <!-- same url as above --> name="CasLoginTicket" slidingExpiration="true" timeout="30" /> </authentication>
We've tried tweaking most of these parameters. Changing redirectAfterValidation makes it never return from the CAS server. Changing singleSignOut to true and adding serviceTicketManager="CacheServiceTicketManager" changed nothing.
Changing the ticket cookie name to "esri_auth" got rid of the loop, but resulted in no login.
And I checked on browser cookie settings; we're accepting 1st- and 3rd-party cookies, as well as session cookies.
I don't have all the details, since I didn't implement it, but we were able to talk with the CAS server via SAML. That took care of the problem.