Versions Compared

Old Version 28

changes.mady.by.user Brian Donnelly

Saved on

compared with

New Version Current

changes.mady.by.user Tom Poage

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

NOTE: UC Davis no longer maintains the ISAPI CAS client. ISAPI is deprecated by Microsoft. Use at your own risk.

CASAuthN ISAPI Client

Section


Column
width30%


Panel
borderStyle
borderColor#BF9900
bgColor#FFFFFF
titleBGColor#E5D699
borderStylesolid
titleIn this Sectionsolid
Table of Contents
indent15px
stylenone



Column


Note
titleRelease Notes
  • Version 2.2 - Nov 25, 2013
    • Chrome interoperability issue fixed.
  • Version 2.1 - Aug 19, 2010
    • A security vulnerability with the authentication header was fixed.
  • Version 2.0 - Feb 09, 2010
    • Two new versions of the CAS ISAPI module have been released. Windows Server 2008 can run in 64-bit mode, which requires a specially-compiled binary. For users of Windows Server 2008 32-bit instances and earlier operating systems, please use the 32-bit installer.
    • This release also fixes the issue with secondary cookies causing CAS authentications to fail.
    • MsMXL 6.0 or newer must be installed. MsXML 6.0 can be downloaded from: http://www.microsoft.com/Downloads/details.aspx?familyid=993C0BCF-3BCF-4009-BE21-27E85E1857B1&displaylang=en
    • These modules may only be used with CAS servers running commercial certificates.

Overview

Windows Internet Information (IIS) server is used to deliver web sites and applications for numerous departments. While the newest versions of IIS suppport .NET technology for which there is a well-supported CAS authentication module, older applications rely on ISAPI, the Information Server Application Programming Interface. Unfortunately, there is little or no support for an ISAPI CAS module. In order to support our IIS clients, we have created an ISAPI client module.

Alternatives

Ja-Sig provides links to several ISAPI modules developed by other organizations. If you encounter problems with the UC Davis ISAPI module, you can try the modules listed at http://www.ja-sig.org/wiki/display/CASC/ISAPI+Filter.


Download

Attachments

Installation Instructions

Include Page

...

CAS ISAPI Installation

...

CAS ISAPI Installation

Classlist / User File Configuration

...

  • Red Arrow in IIS Administrator
    • Access Permissions: Make sure the IIS group (whatever group the IWAM_MACHINENAME user belongs to) has read access to its location.
    • Registry Keys: The CAS ISAPI module stores its configuration in the system registry during install. Check that the following keys exist and are populated:
      • /HKEY_LOCAL_MACHINE/SOFTWARE/CASAuthN
      • /HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/EventLog/Application/CASAuthN
    • Isolation Mode: Try turning on IIS 5.0 Isolation mode. In the IIS Adminsistrator, Right Click on the 'Web Sites' folder and choose 'Properties'. In the properties window, select the 'Service' tab, and make sure the Checkbox labeled 'Run WWW service in IIS 5.0 Isolation mode' is checked. Then restart IIS.
  • It's not redirecting
    • Make sure the filter is loading. Under the Internet Information Services panel, look for the filter where you applied it earlier, and make sure there is a green arrow up next to it. Make sure the IIS group (whatever group the IWAM_MACHINENAME user belongs to) has read access to its location.
  • Redirection Limit Exceeded Error
    • Ensure that your links and/or users are accessing protected resources via a url with your site's domain name and not IP address. The ISAPI plugin requires that users access the protected website via its configured domain name. Additionally, domain names must be inside the ucdavis.edu domain.
  • Unable to create an XML Document Instance
    • If the CAS module is not working, and you see messages in the Application Log that reference "unable to create an XML Document Instance", try installing MSXML 4 Service Pack 2 or higher. This has been reported in some Windows Server 2008 installations.
  • The CASAuthN Authentication filter was unable to validate the authentication cookie
    This version of the ISAPI module cannot make https connections to cas servers that run with self-signed certificates. When using the UC Davis CAS service, always make sure the ServerURL parameter is set to https://cas.ucdavis.edu/cas
  • Other Problems
    • Please contact distauth@ucdaviswebsso@ucdavis.edu if you need additional assistance.