3

We have a new install of ArcGIS Portal running with the WebAdaptor using IIS. If we login directly, it works just fine. However, we have a mandate to use a CAS login process, and when we enable that, we end up with a redirect loop upon login.

What definitely happens is that, when you go to the main page, it does redirect to the CAS server, and then redirects back to the home page. However, it seems to not find the cookie with the CAS-generated token there, and redirects back to the signin page. The signin page finds it in the session, I guess (at least, it definitely doesn't go back to the CAS server), and redirects back to the home page, and the loop continues until the browser calls a stop to it.

The CAS client is the DotNetCasClient, and its configuration in the Web.config for the WebAdaptor app has:

<configuration>
  <configSections>
    <section name="casClientConfig" type="DotNetCasClient.Configuration.CasClientConfiguration, DotNotCasClient" />
  </configSections>
  <casClientConfig casServerLoginUrl="https://loginHost/cas/login"
               casServerUrlPrefix="https://loginHost/cas"
               serverName="https://portalServer"
               redirectAfterValidation="true"
               gateway="false"
               renew="false"
               singleSignOut="false"
               ticketValidatorName="Cas10" />
...
  <system.web>
...
    <authentication mode="Forms">
       <forms cookieless="UseCookies"
          domain="our-domain" <!-- CAS and portal are both in same domain -->
          loginUrl="https://loginServer/cas/login" <!-- same url as above -->
          name="CasLoginTicket"
          slidingExpiration="true"
          timeout="30" />
    </authentication>

...

We've tried tweaking most of these parameters. Changing redirectAfterValidation makes it never return from the CAS server. Changing singleSignOut to true and adding serviceTicketManager="CacheServiceTicketManager" changed nothing.

Changing the ticket cookie name to "esri_auth" got rid of the loop, but resulted in no login.

And I checked on browser cookie settings; we're accepting 1st- and 3rd-party cookies, as well as session cookies.

Any ideas?


I don't have all the details, since I didn't implement it, but we were able to talk with the CAS server via SAML. That took care of the problem.

closed as off-topic by Midavalo Jun 21 '18 at 20:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This problem cannot or can no longer be reproduced. Changes to the system or to the asker's circumstances may have rendered the question obsolete, or the question does not include a procedure to enable potential answerers to reproduce the same symptoms. Such questions are off-topic as they are unlikely to help future readers, but editing them to include more details can lead to re-opening." – Midavalo
If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.