CAS Problems
Kevin Jordan
kmj7777 at gmail.com
Wed Sep 27 00:30:10 EDT 2006
Switching it back over to a self-signed certificate in the keystore fixed
that. I tried doing a p12 certificate, but it didn't like that much either
(something with the RSA modulus size).
On 9/26/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
>
> It's looking like in the logs this error is repeating over and over (and
> somehow generated 2.7GB worth):
>
> Sep 27, 2006 12:00:00 AM org.apache.tomcat.util.net.PoolTcpEndpointacceptSocket
> SEVERE: Endpoint [SSL: ServerSocket[addr=
> 0.0.0.0/0.0.0.0,port=0,localport=8443]<http://0.0.0.0/0.0.0.0,port=0,localport=8443%5D>]
> ignored exception: java.net.SocketException: SSL handshake
> errorjavax.net.ssl.
> SSLException: No available certificate corresponds to the SSL cipher
> suites which are enabled.
> java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException:
> No available certificate corresponds to the SSL cipher suites which are
> enabled.
> at org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(
> JSSESocketFactory.java:113)
> at org.apache.tomcat.util.net.PoolTcpEndpoint.acceptSocket(
> PoolTcpEndpoint.java:407)
> at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(
> LeaderFollowerWorkerThread.java :70)
> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(
> ThreadPool.java:684)
> at java.lang.Thread.run(Thread.java:534)
>
> I'm not sure if this was the problem before I upgraded and started over,
> but it does seem to be now. I've generated my certificates from
> cacert.org, so do you know where I set the cipher suites?
>
> On 9/26/06, Kevin Jordan < kmj7777 at gmail.com> wrote:
> >
> > Well, this is a fresh install with just mod_jk and SSL enabled with CAS
> > thrown in so I'm not sure what it is. I'll look into JMX though.
> >
> > On 9/26/06, Scott Battaglia <scott.battaglia at gmail.com> wrote:
> > >
> > > That's strange. We're running Java 1.5 and Tomcat 5.5 in production
> > > (and in test under heavy load) and not seeing 100% Java CPU utilization.
> > > Could there be some kind of misconfiguration? Can you connect via JMX to
> > > the JVM or Tomcat and see if there is anything out of the ordinary going on?
> > >
> > >
> > > -Scott
> > >
> > > On 9/26/06, Kevin Jordan < kmj7777 at gmail.com> wrote:
> > > >
> > > > Yeah, it happens with Tomcat 5 with Java 1.5, Tomcat 5.5 with Java
> > > > 1.5, and Tomcat 5.5 with Java 1.4.
> > > >
> > > > On 9/26/06, Scott Battaglia < scott.battaglia at gmail.com> wrote:
> > > > >
> > > > > Does this happen in a test/loadtest environment? With Java 1.5?
> > > > > We generally use Tomcat 5.5 with Java 1.5 (we also run on
> > > > > Solaris).
> > > > >
> > > > > -Scott
> > > > >
> > > > >
> > > > > On 9/25/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
> > > > > >
> > > > > > At the time, around 10 or less, and it idles that high as well.
> > > > > > We're running it on Tomcat 5.5 with Java 1.4.2 on Gentoo Linux.
> > > > > >
> > > > > > On 9/25/06, Scott Battaglia <scott.battaglia at gmail.com> wrote:
> > > > > > >
> > > > > > > That seems very high. How many authentications are you
> > > > > > > doing? What type of machine is it?
> > > > > > >
> > > > > > > On 9/25/06, Kevin Jordan < kmj7777 at gmail.com> wrote:
> > > > > > > >
> > > > > > > > I ended up just deleting the cas directory and having it
> > > > > > > > restore itself from the war file and it seems to work now. However, java is
> > > > > > > > still at 99-100% CPU usage.
> > > > > > > >
> > > > > > > > On 9/25/06, Scott Battaglia <scott.battaglia at gmail.com>
> > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > Are there any errors in your Tomcat log? Did you do a
> > > > > > > > > thread dump before you restarted the server? If so, please pass those
> > > > > > > > > along.
> > > > > > > > >
> > > > > > > > > Thanks
> > > > > > > > > -Scott
> > > > > > > > >
> > > > > > > > > On 9/25/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
> > > > > > > > >
> > > > > > > > > > My CAS was working well up until Friday and then Java
> > > > > > > > > > started taking 100% of the CPU (still is, and I changed JDKs and upgraded
> > > > > > > > > > Tomcat and CAS) which interferred with my LDAP on the same machine. Now
> > > > > > > > > > I've moved LDAP off and that's fine, and it worked for the first couple
> > > > > > > > > > logins, but now I'm getting this error:
> > > > > > > > > >
> > > > > > > > > > 5AE5 .START ****************** [CAS.php:396]
> > > > > > > > > > 5AE5 .=> phpCAS::client('2.0', 'cerberus.xteconline.com ',
> > > > > > > > > > 443, '/cas', true) [headerCAS.php:32]
> > > > > > > > > > 5AE5 .| => CASClient::CASClient(' 2.0', false, '
> > > > > > > > > > cerberus.xteconline.com', 443, '/cas', true) [CAS.php
> > > > > > > > > > :297]
> > > > > > > > > > 5AE5 .| | ST
> > > > > > > > > > 'ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20' found [
> > > > > > > > > > client.php:537]
> > > > > > > > > > 5AE5 .| <= ''
> > > > > > > > > > 5AE5 .<= ''
> > > > > > > > > > 5AE5 .=> phpCAS::forceAuthentication() [headerCAS.php
> > > > > > > > > > :33]
> > > > > > > > > > 5AE5 .| => CASClient::forceAuthentication() [CAS.php
> > > > > > > > > > :873]
> > > > > > > > > > 5AE5 .| | => CASClient::isAuthenticated() [
> > > > > > > > > > client.php:615]
> > > > > > > > > > 5AE5 .| | | =>
> > > > > > > > > > CASClient::wasPreviouslyAuthenticated() [client.php:670]
> > > > > > > > > > 5AE5 .| | | | no user found [client.php:771]
> > > > > > > > > > 5AE5 .| | | <= false
> > > > > > > > > > 5AE5 .| | | ST
> > > > > > > > > > `ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20' is present [
> > > > > > > > > > client.php:677]
> > > > > > > > > > 5AE5 .| | | => CASClient::validateST('', NULL,
> > > > > > > > > > NULL) [client.php:678]
> > > > > > > > > > 5AE5 .| | | | => CASClient::getURL() [
> > > > > > > > > > client.php:366]
> > > > > > > > > > 5AE5 .| | | | <= 'http://apache01.xteconline.com/dmt/
> > > > > > > > > > '
> > > > > > > > > > 5AE5 .| | | | => CASClient::readURL('https://cerberus.xteconline.com:443/cas/serviceValidate?service=http://apache0
> > > > > > > > > >
> > > > > > > > > > 1.xteconline.com/dmt/&ticket=ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20
> > > > > > > > > > ', '', NULL, NULL, NULL) [client.php:905]
> > > > > > > > > > 5AE5 .| | | | <= true
> > > > > > > > > > 5AE5 .| | | | bad XML root node (should be
> > > > > > > > > > `serviceResponse' instead of `' [client.php:956]
> > > > > > > > > > 5AE5 .| | | | => CASClient::authError('ST
> > > > > > > > > > not validated', '
> > > > > > > > > > https://cerberus.xteconline.com:443/cas/serviceValidate?
> > > > > > > > > > service=http://apache01.xteconline.com/dmt/&ticket=ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20',
> > > > > > > > > > false, true, false) [client.p
> > > > > > > > > > hp:961]
> > > > > > > > > > 5AE5 .| | | | | => CASClient::getURL() [
> > > > > > > > > > client.php:1967]
> > > > > > > > > > 5AE5 .| | | | | <= '
> > > > > > > > > > http://apache01.xteconline.com/dmt/'
> > > > > > > > > > 5AE5 .| | | | | CAS URL:
> > > > > > > > > > https://cerberus.xteconline.com:443/cas/serviceValidate?service=http://apache01.xteconl
> > > > > > > > > > ine.com/dmt/&ticket=ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20
> > > > > > > > > > [client.php:1968]
> > > > > > > > > > 5AE5 .| | | | | Authentication failure:
> > > > > > > > > > ST not validated [client.php:1969]
> > > > > > > > > > 5AE5 .| | | | | Reason: bad response from
> > > > > > > > > > the CAS server [client.php:1974]
> > > > > > > > > > 5AE5 .| | | | | CAS response: [
> > > > > > > > > > client.php:1988]
> > > > > > > > > > 5AE5 .| | | | | exit()
> > > > > > > > > > 5AE5 .| | | | | -
> > > > > > > > > > 5AE5 .| | | | -
> > > > > > > > > > 5AE5 .| | | -
> > > > > > > > > > 5AE5 .| | -
> > > > > > > > > > 5AE5 .| -
> > > > > > > > > >
> > > > > > > > > > What happened? Why am I getting an empty
> > > > > > > > > > serviceReponse? I've upgraded phpCAS as well and I still get that error...
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Kevin Jordan
> > > > > > > > > > _______________________________________________
> > > > > > > > > > Yale CAS mailing list
> > > > > > > > > > cas at tp.its.yale.edu
> > > > > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > > _______________________________________________
> > > > > > > > > Yale CAS mailing list
> > > > > > > > > cas at tp.its.yale.edu
> > > > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Kevin Jordan
> > > > > > > > _______________________________________________
> > > > > > > > Yale CAS mailing list
> > > > > > > > cas at tp.its.yale.edu
> > > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Yale CAS mailing list
> > > > > > > cas at tp.its.yale.edu
> > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Kevin Jordan
> > > > > >
> > > > > > _______________________________________________
> > > > > > Yale CAS mailing list
> > > > > > cas at tp.its.yale.edu
> > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > > _______________________________________________
> > > > > Yale CAS mailing list
> > > > > cas at tp.its.yale.edu
> > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > > --
> > > > Kevin Jordan
> > > >
> > > > _______________________________________________
> > > > Yale CAS mailing list
> > > > cas at tp.its.yale.edu
> > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > >
> > > >
> > > >
> > >
> > > _______________________________________________
> > > Yale CAS mailing list
> > > cas at tp.its.yale.edu
> > > http://tp.its.yale.edu/mailman/listinfo/cas
> > >
> > >
> > >
> >
> >
> > --
> > Kevin Jordan
> >
>
>
>
> --
> Kevin Jordan
--
Kevin Jordan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://tp.its.yale.edu/pipermail/cas/attachments/20060926/7f2b006b/attachment.html
More information about the cas
mailing list