CAS Problems

Wed Sep 27 07:44:03 EDT 2006

Did your CPU utilization go down at all though?

On 9/27/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
>
> Switching it back over to a self-signed certificate in the keystore fixed
> that.  I tried doing a p12 certificate, but it didn't like that much either
> (something with the RSA modulus size).
>
> On 9/26/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
> >
> > It's looking like in the logs this error is repeating over and over (and
> > somehow generated 2.7GB worth):
> >
> > Sep 27, 2006 12:00:00 AM org.apache.tomcat.util.net.PoolTcpEndpointacceptSocket
> > SEVERE: Endpoint [SSL: ServerSocket[addr=
> > 0.0.0.0/0.0.0.0,port=0,localport=8443]<http://0.0.0.0/0.0.0.0,port=0,localport=8443%5D>]
> > ignored exception: java.net.SocketException: SSL handshake
> > errorjavax.net.ssl.
> > SSLException: No available certificate corresponds to the SSL cipher
> > suites which are enabled.
> > java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException:
> > No available certificate corresponds to the SSL cipher suites which are
> > enabled.
> >         at
> > org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket (
> > JSSESocketFactory.java:113)
> >         at org.apache.tomcat.util.net.PoolTcpEndpoint.acceptSocket(
> > PoolTcpEndpoint.java:407)
> >         at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(
> > LeaderFollowerWorkerThread.java :70)
> >         at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run
> > (ThreadPool.java:684)
> >         at java.lang.Thread.run(Thread.java:534)
> >
> > I'm not sure if this was the problem before I upgraded and started over,
> > but it does seem to be now.  I've generated my certificates from
> > cacert.org, so do you know where I set the cipher suites?
> >
> > On 9/26/06, Kevin Jordan < kmj7777 at gmail.com> wrote:
> > >
> > > Well, this is a fresh install with just mod_jk and SSL enabled with
> > > CAS thrown in so I'm not sure what it is.  I'll look into JMX though.
> > >
> > > On 9/26/06, Scott Battaglia <scott.battaglia at gmail.com> wrote:
> > > >
> > > > That's strange. We're running Java 1.5 and Tomcat 5.5 in production
> > > > (and in test under heavy load) and not seeing 100% Java CPU utilization.
> > > > Could there be some kind of misconfiguration?  Can you connect via JMX to
> > > > the JVM or Tomcat and see if there is anything out of the ordinary going on?
> > > >
> > > >
> > > > -Scott
> > > >
> > > > On 9/26/06, Kevin Jordan < kmj7777 at gmail.com> wrote:
> > > > >
> > > > > Yeah, it happens with Tomcat 5 with Java 1.5, Tomcat 5.5 with Java
> > > > > 1.5, and Tomcat 5.5 with Java 1.4.
> > > > >
> > > > > On 9/26/06, Scott Battaglia < scott.battaglia at gmail.com> wrote:
> > > > > >
> > > > > > Does this happen in a test/loadtest environment?  With Java 1.5?
> > > > > > We generally use Tomcat 5.5 with Java 1.5 (we also run on
> > > > > > Solaris).
> > > > > >
> > > > > > -Scott
> > > > > >
> > > > > >
> > > > > > On 9/25/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
> > > > > > >
> > > > > > > At the time, around 10 or less, and it idles that high as
> > > > > > > well.  We're running it on Tomcat 5.5 with Java 1.4.2 on
> > > > > > > Gentoo Linux.
> > > > > > >
> > > > > > > On 9/25/06, Scott Battaglia <scott.battaglia at gmail.com> wrote:
> > > > > > > >
> > > > > > > > That seems very high.  How many authentications are you
> > > > > > > > doing?  What type of machine is it?
> > > > > > > >
> > > > > > > > On 9/25/06, Kevin Jordan < kmj7777 at gmail.com> wrote:
> > > > > > > > >
> > > > > > > > > I ended up just deleting the cas directory and having it
> > > > > > > > > restore itself from the war file and it seems to work now.  However, java is
> > > > > > > > > still at 99-100% CPU usage.
> > > > > > > > >
> > > > > > > > > On 9/25/06, Scott Battaglia <scott.battaglia at gmail.com>
> > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > Are there any errors in your Tomcat log?   Did you do a
> > > > > > > > > > thread dump before you restarted the server?  If so, please pass those
> > > > > > > > > > along.
> > > > > > > > > >
> > > > > > > > > > Thanks
> > > > > > > > > > -Scott
> > > > > > > > > >
> > > > > > > > > > On 9/25/06, Kevin Jordan <kmj7777 at gmail.com> wrote:
> > > > > > > > > >
> > > > > > > > > > >  My CAS was working well up until Friday and then Java
> > > > > > > > > > > started taking 100% of the CPU (still is, and I changed JDKs and upgraded
> > > > > > > > > > > Tomcat and CAS) which interferred with my LDAP on the same machine.  Now
> > > > > > > > > > > I've moved LDAP off and that's fine, and it worked for the first couple
> > > > > > > > > > > logins, but now I'm getting this error:
> > > > > > > > > > >
> > > > > > > > > > > 5AE5 .START ****************** [CAS.php:396]
> > > > > > > > > > > 5AE5 .=> phpCAS::client('2.0', 'cerberus.xteconline.com
> > > > > > > > > > > ', 443, '/cas', true) [headerCAS.php:32]
> > > > > > > > > > > 5AE5 .|    => CASClient::CASClient(' 2.0', false, '
> > > > > > > > > > > cerberus.xteconline.com', 443, '/cas', true) [CAS.php
> > > > > > > > > > > :297]
> > > > > > > > > > > 5AE5 .|    |    ST
> > > > > > > > > > > 'ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20' found [
> > > > > > > > > > > client.php:537]
> > > > > > > > > > > 5AE5 .|    <= ''
> > > > > > > > > > > 5AE5 .<= ''
> > > > > > > > > > > 5AE5 .=> phpCAS::forceAuthentication() [headerCAS.php
> > > > > > > > > > > :33]
> > > > > > > > > > > 5AE5 .|    => CASClient::forceAuthentication() [
> > > > > > > > > > > CAS.php:873]
> > > > > > > > > > > 5AE5 .|    |    => CASClient::isAuthenticated() [
> > > > > > > > > > > client.php:615]
> > > > > > > > > > > 5AE5 .|    |    |    =>
> > > > > > > > > > > CASClient::wasPreviouslyAuthenticated() [client.php
> > > > > > > > > > > :670]
> > > > > > > > > > > 5AE5 .|    |    |    |    no user found [client.php
> > > > > > > > > > > :771]
> > > > > > > > > > > 5AE5 .|    |    |    <= false
> > > > > > > > > > > 5AE5 .|    |    |    ST
> > > > > > > > > > > `ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20' is present [
> > > > > > > > > > > client.php:677]
> > > > > > > > > > > 5AE5 .|    |    |    => CASClient::validateST('',
> > > > > > > > > > > NULL, NULL) [client.php:678]
> > > > > > > > > > > 5AE5 .|    |    |    |    => CASClient::getURL() [
> > > > > > > > > > > client.php:366]
> > > > > > > > > > > 5AE5 .|    |    |    |    <= 'http://apache01.xteconline.com/dmt/
> > > > > > > > > > > '
> > > > > > > > > > > 5AE5 .|    |    |    |    => CASClient::readURL('https://cerberus.xteconline.com:443/cas/serviceValidate?service=http://apache0
> > > > > > > > > > >
> > > > > > > > > > > 1.xteconline.com/dmt/&ticket=ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20
> > > > > > > > > > > ', '', NULL, NULL, NULL) [client.php:905]
> > > > > > > > > > > 5AE5 .|    |    |    |    <= true
> > > > > > > > > > > 5AE5 .|    |    |    |    bad XML root node (should be
> > > > > > > > > > > `serviceResponse' instead of `' [client.php:956]
> > > > > > > > > > > 5AE5 .|    |    |    |    => CASClient::authError('ST
> > > > > > > > > > > not validated', '
> > > > > > > > > > > https://cerberus.xteconline.com:443/cas/serviceValidate
> > > > > > > > > > > ?
> > > > > > > > > > > service=http://apache01.xteconline.com/dmt/&ticket=ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20',
> > > > > > > > > > > false, true, false) [client.p
> > > > > > > > > > > hp:961]
> > > > > > > > > > > 5AE5 .|    |    |    |    |    => CASClient::getURL()
> > > > > > > > > > > [client.php:1967]
> > > > > > > > > > > 5AE5 .|    |    |    |    |    <= '
> > > > > > > > > > > http://apache01.xteconline.com/dmt/'
> > > > > > > > > > > 5AE5 .|    |    |    |    |    CAS URL:
> > > > > > > > > > > https://cerberus.xteconline.com:443/cas/serviceValidate?service=http://apache01.xteconl
> > > > > > > > > > > ine.com/dmt/&ticket=ST-14-eIdaNesjRgYwnbA6PRQgl11vRiOfKtFiH6k-20
> > > > > > > > > > > [client.php:1968]
> > > > > > > > > > > 5AE5 .|    |    |    |    |    Authentication failure:
> > > > > > > > > > > ST not validated [client.php:1969]
> > > > > > > > > > > 5AE5 .|    |    |    |    |    Reason: bad response
> > > > > > > > > > > from the CAS server [client.php:1974]
> > > > > > > > > > > 5AE5 .|    |    |    |    |    CAS response:  [
> > > > > > > > > > > client.php:1988]
> > > > > > > > > > > 5AE5 .|    |    |    |    |    exit()
> > > > > > > > > > > 5AE5 .|    |    |    |    |    -
> > > > > > > > > > > 5AE5 .|    |    |    |    -
> > > > > > > > > > > 5AE5 .|    |    |    -
> > > > > > > > > > > 5AE5 .|    |    -
> > > > > > > > > > > 5AE5 .|    -
> > > > > > > > > > >
> > > > > > > > > > > What happened?  Why am I getting an empty
> > > > > > > > > > > serviceReponse?  I've upgraded phpCAS as well and I still get that error...
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Kevin Jordan
> > > > > > > > > > > _______________________________________________
> > > > > > > > > > > Yale CAS mailing list
> > > > > > > > > > > cas at tp.its.yale.edu
> > > > > > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > _______________________________________________
> > > > > > > > > > Yale CAS mailing list
> > > > > > > > > > cas at tp.its.yale.edu
> > > > > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Kevin Jordan
> > > > > > > > > _______________________________________________
> > > > > > > > > Yale CAS mailing list
> > > > > > > > > cas at tp.its.yale.edu
> > > > > > > > >  http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Yale CAS mailing list
> > > > > > > > cas at tp.its.yale.edu
> > > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Kevin Jordan
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Yale CAS mailing list
> > > > > > > cas at tp.its.yale.edu
> > > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > Yale CAS mailing list
> > > > > > cas at tp.its.yale.edu
> > > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Kevin Jordan
> > > > >
> > > > > _______________________________________________
> > > > > Yale CAS mailing list
> > > > > cas at tp.its.yale.edu
> > > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > > >
> > > > >
> > > > >
> > > >
> > > > _______________________________________________
> > > > Yale CAS mailing list
> > > > cas at tp.its.yale.edu
> > > > http://tp.its.yale.edu/mailman/listinfo/cas
> > > >
> > > >
> > > >
> > >
> > >
> > > --
> > > Kevin Jordan
> > >
> >
> >
> >
> > --
> > Kevin Jordan
>
>
>
>
> --
> Kevin Jordan
> _______________________________________________
> Yale CAS mailing list
> cas at tp.its.yale.edu
> http://tp.its.yale.edu/mailman/listinfo/cas
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://tp.its.yale.edu/pipermail/cas/attachments/20060927/fcf73d05/attachment.html