CAS with WebLogic Authenticates then error with 'principal' cannot be null - spring

Question

I am trying to implement CAS with WebLogic 10.3.5 and not having much luck. Everything I read is about CAS with Tomcat. Have tried the exact config with Tomcat and it works like a dream but those in charge wont change to Tomcat. Anyways....
I can bring up the CAS login screen, and after checking the cas.log it authenticates but then seems to lose the principal.
I am using the maven overlay technique which seems good to begin with.
Also had the standard log4j dramas that everyone seems to have.
Have included stacktrace, deployerConfigContext.xml, pom.xml and weblogic.xml.
Here is the stacktrace:
2014-05-09 15:29:32,000 INFO [org.jasig.cas.ticket.registry.support.DefaultTicketRegistryCleaner] - <Beginning ticket cleanup.>
2014-05-09 15:29:32,000 INFO [org.jasig.cas.ticket.registry.support.DefaultTicketRegistryCleaner] - <0 tickets found to be removed.>
2014-05-09 15:29:32,000 INFO [org.jasig.cas.ticket.registry.support.DefaultTicketRegistryCleaner] - <Finished ticket cleanup.>
2014-05-09 15:29:37,443 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - <org.jasig.cas.adaptors.generic.AcceptUsersAuthenticationHandler successfully authenticated [username: kwins]>
2014-05-09 15:29:37,445 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - <Resolved principal kwins>
2014-05-09 15:29:37,445 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - <org.jasig.cas.adaptors.generic.AcceptUsersAuthenticationHandler#120445d authenticated kwins with credential [username: kwins].>
2014-05-09 15:29:37,458 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: [username: kwins]
WHAT: supplied credentials: [username: kwins]
ACTION: AUTHENTICATION_SUCCESS
APPLICATION: CAS
WHEN: Fri May 09 15:29:37 EST 2014
CLIENT IP ADDRESS: 192.168.1.140
SERVER IP ADDRESS: 192.168.1.140
=============================================================
>
<09/05/2014 3:29:37 PM EST> <Error> <HTTP> <BEA-101017> <[ServletContext#1230935[app:cas module:cas.war path:/cas spec-version:2.5], request: weblogic.servlet.internal.ServletRequestImpl#2eb99e[
POST /cas/login HTTP/1.1
Connection: keep-alive
Content-Length: 114
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://lh11-24.custman.com.au:7001
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://lh11-24.custman.com.au:7001/cas/login
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: ADMINCONSOLESESSION=J5fJTszB6RS91Y50wpZnqpBbPM7fpp12LQTvcPs1tnkP9GLKhhvT!-2133794881; JSESSIONID=sJ92Ts4pPgvtJPRMDT5zNLjbndXRLNPJCfj9B3x1TGX5J03XlpHN!-317454516
]] Root cause of ServletException.
org.springframework.webflow.execution.ActionExecutionException: Exception thrown executing [AnnotatedAction#1b55376 targetAction = [EvaluateAction#17a89ad expression = authenticationViaFormAction.submit(flowRequestContext, flowScope.credentials, messageContext), resultExpression = [null]], attributes = map[[empty]]] in state 'realSubmit' of flow 'login' -- action execution attributes were 'map[[empty]]'
at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:60)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:101)
at org.springframework.webflow.engine.State.enter(State.java:194)
at org.springframework.webflow.engine.Transition.execute(Transition.java:227)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:393)
Truncated. see log file for complete stacktrace
Caused By: org.springframework.binding.expression.EvaluationException: An OgnlException occurred getting the value for expression 'authenticationViaFormAction.submit(flowRequestContext, flowScope.credentials, messageContext)' on context [class org.springframework.webflow.engine.impl.RequestControlContextImpl]
at org.springframework.binding.expression.ognl.OgnlExpression.getValue(OgnlExpression.java:92)
at org.springframework.webflow.action.EvaluateAction.doExecute(EvaluateAction.java:75)
at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188)
at org.springframework.webflow.execution.AnnotatedAction.execute(AnnotatedAction.java:145)
at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51)
Truncated. see log file for complete stacktrace
Caused By: ognl.MethodFailedException: Method "submit" failed for object org.jasig.cas.web.flow.AuthenticationViaFormAction#ea66aa [java.lang.IllegalArgumentException: 'principal' cannot be null.
Check the correctness of #Audit annotation at the following audit point: execution(public abstract java.lang.String org.jasig.cas.CentralAuthenticationService.createTicketGrantingTicket(org.jasig.cas.authentication.principal.Credentials))]
at ognl.OgnlRuntime.callAppropriateMethod(OgnlRuntime.java:1265)
at ognl.ObjectMethodAccessor.callMethod(ObjectMethodAccessor.java:68)
at ognl.OgnlRuntime.callMethod(OgnlRuntime.java:1329)
at ognl.ASTMethod.getValueBody(ASTMethod.java:90)
at ognl.SimpleNode.evaluateGetValueBody(SimpleNode.java:212)
Truncated. see log file for complete stacktrace
Caused By: java.lang.IllegalArgumentException: 'principal' cannot be null.
Check the correctness of #Audit annotation at the following audit point: execution(public abstract java.lang.String org.jasig.cas.CentralAuthenticationService.createTicketGrantingTicket(org.jasig.cas.authentication.principal.Credentials))
at com.github.inspektr.audit.AuditActionContext.assertNotNull(AuditActionContext.java:81)
at com.github.inspektr.audit.AuditActionContext.<init>(AuditActionContext.java:63)
at com.github.inspektr.audit.AuditTrailManagementAspect.executeAuditCode(AuditTrailManagementAspect.java:149)
at com.github.inspektr.audit.AuditTrailManagementAspect.handleAuditTrail(AuditTrailManagementAspect.java:139)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
Truncated. see log file for complete stacktrace
>
deployerConfigContext.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
xmlns:tx="http://www.springframework.org/schema/tx" xmlns:sec="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<!-- | This bean declares our AuthenticationManager. The CentralAuthenticationService
service bean | declared in applicationContext.xml picks up this AuthenticationManager
by reference to its id, | "authenticationManager". Most deployers will be
able to use the default AuthenticationManager | implementation and so do
not need to change the class of this bean. We include the whole | AuthenticationManager
here in the userConfigContext.xml so that you can see the things you will
| need to change in context. + -->
<bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl">
<!-- Uncomment the metadata populator to allow clearpass to capture and
cache the password This switch effectively will turn on clearpass. <property
name="authenticationMetaDataPopulators"> <list> <bean class="org.jasig.cas.extension.clearpass.CacheCredentialsMetaDataPopulator">
<constructor-arg index="0" ref="credentialsCache" /> </bean> </list> </property> -->
<!-- | This is the List of CredentialToPrincipalResolvers that identify
what Principal is trying to authenticate. | The AuthenticationManagerImpl
considers them in order, finding a CredentialToPrincipalResolver which |
supports the presented credentials. | | AuthenticationManagerImpl uses these
resolvers for two purposes. First, it uses them to identify the Principal
| attempting to authenticate to CAS /login . In the default configuration,
it is the DefaultCredentialsToPrincipalResolver | that fills this role. If
you are using some other kind of credentials than UsernamePasswordCredentials,
you will need to replace | DefaultCredentialsToPrincipalResolver with a CredentialsToPrincipalResolver
that supports the credentials you are | using. | | Second, AuthenticationManagerImpl
uses these resolvers to identify a service requesting a proxy granting ticket.
| In the default configuration, it is the HttpBasedServiceCredentialsToPrincipalResolver
that serves this purpose. | You will need to change this list if you are
identifying services by something more or other than their callback URL.
+ -->
<property name="credentialsToPrincipalResolvers">
<list>
<!-- | UsernamePasswordCredentialsToPrincipalResolver supports the UsernamePasswordCredentials
that we use for /login | by default and produces SimplePrincipal instances
conveying the username from the credentials. | | If you've changed your LoginFormAction
to use credentials other than UsernamePasswordCredentials then you will also
| need to change this bean declaration (or add additional declarations) to
declare a CredentialsToPrincipalResolver that supports the | Credentials
you are using. + -->
<bean
class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver">
<property name="attributeRepository" ref="attributeRepository" />
</bean>
<!-- | HttpBasedServiceCredentialsToPrincipalResolver supports HttpBasedCredentials.
It supports the CAS 2.0 approach of | authenticating services by SSL callback,
extracting the callback URL from the Credentials and representing it as a
| SimpleService identified by that callback URL. | | If you are representing
services by something more or other than an HTTPS URL whereat they are able
to | receive a proxy callback, you will need to change this bean declaration
(or add additional declarations). + -->
<bean
class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
</list>
</property>
<!-- | Whereas CredentialsToPrincipalResolvers identify who it is some
Credentials might authenticate, | AuthenticationHandlers actually authenticate
credentials. Here we declare the AuthenticationHandlers that | authenticate
the Principals that the CredentialsToPrincipalResolvers identified. CAS will
try these handlers in turn | until it finds one that both supports the Credentials
presented and succeeds in authenticating. + -->
<property name="authenticationHandlers">
<list>
<!-- | This is the authentication handler that authenticates services
by means of callback via SSL, thereby validating | a server side SSL certificate.
+ -->
<bean
class="org.jasig.cas.adaptors.generic.AcceptUsersAuthenticationHandler">
<property name="users">
<map>
<entry>
<key>
<value>kwins</value>
</key>
<value>welcome</value>
</entry>
<entry>
<key>
<value>weblogic</value>
</key>
<value>welcome1</value>
</entry>
</map>
</property>
</bean>
<!-- | This is the authentication handler declaration that every CAS
deployer will need to change before deploying CAS | into production. The
default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials
| where the username equals the password. You will need to replace this with
an AuthenticationHandler that implements your | local authentication strategy.
You might accomplish this by coding a new such handler and declaring | edu.someschool.its.cas.MySpecialHandler
here, or you might use one of the handlers provided in the adaptors modules.
+ -->
<bean
class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />
</list>
</property>
</bean>
<!-- This bean defines the security roles for the Services Management application.
Simple deployments can use the in-memory version. More robust deployments
will want to use another option, such as the Jdbc version. The name of this
should remain "userDetailsService" in order for Spring Security to find it. -->
<!-- <sec:user name="##THIS SHOULD BE REPLACED##" password="notused" authorities="ROLE_ADMIN"
/> -->
<sec:user-service id="userDetailsService">
<sec:user name="weblogic" password="welcome1"
authorities="ROLE_ADMIN" />
</sec:user-service>
<!-- Bean that defines the attributes that a service may return. This example
uses the Stub/Mock version. A real implementation may go against a database
or LDAP server. The id should remain "attributeRepository" though. -->
<bean id="attributeRepository"
class="org.jasig.services.persondir.support.StubPersonAttributeDao">
<property name="backingMap">
<map>
<entry key="uid" value="uid" />
<entry key="eduPersonAffiliation" value="eduPersonAffiliation" />
<entry key="groupMembership" value="groupMembership" />
</map>
</property>
</bean>
<!-- Sample, in-memory data store for the ServiceRegistry. A real implementation
would probably want to replace this with the JPA-backed ServiceRegistry DAO
The name of this bean should remain "serviceRegistryDao". -->
<bean id="serviceRegistryDao" class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl">
<property name="registeredServices">
<list>
<bean class="org.jasig.cas.services.RegexRegisteredService">
<property name="id" value="0" />
<property name="name" value="HTTP and IMAP" />
<property name="description" value="Allows HTTP(S) and IMAP(S) protocols" />
<property name="serviceId" value="^(https?|imaps?)://.*" />
<property name="evaluationOrder" value="10000001" />
</bean>
<!-- Use the following definition instead of the above to further restrict
access to services within your domain (including subdomains). Note that example.com
must be replaced with the domain you wish to permit. -->
<!-- <bean class="org.jasig.cas.services.RegexRegisteredService"> <property
name="id" value="1" /> <property name="name" value="HTTP and IMAP on example.com"
/> <property name="description" value="Allows HTTP(S) and IMAP(S) protocols
on example.com" /> <property name="serviceId" value="^(https?|imaps?)://([A-Za-z0-9_-]+\.)*example\.com/.*"
/> <property name="evaluationOrder" value="0" /> </bean> -->
</list>
</property>
</bean>
<bean id="auditTrailManager"
class="com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager" />
<bean id="healthCheckMonitor" class="org.jasig.cas.monitor.HealthCheckMonitor">
<property name="monitors">
<list>
<bean class="org.jasig.cas.monitor.MemoryMonitor"
p:freeMemoryWarnThreshold="10" />
<!-- NOTE The following ticket registries support SessionMonitor: * DefaultTicketRegistry
* JpaTicketRegistry Remove this monitor if you use an unsupported registry. -->
<bean class="org.jasig.cas.monitor.SessionMonitor"
p:ticketRegistry-ref="ticketRegistry"
p:serviceTicketCountWarnThreshold="5000"
p:sessionCountWarnThreshold="100000" />
</list>
</property>
</bean>
</beans>
pom.xml
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>portal</groupId>
<artifactId>cas-portal</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>war</packaging>
<name>cas-portal</name>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-war-plugin</artifactId>
<version>2.4</version>
<configuration>
<warName>cas</warName>
</configuration>
</plugin>
</plugins>
</build>
<dependencies>
<dependency>
<groupId>org.jasig.cas</groupId>
<artifactId>cas-server-webapp</artifactId>
<version>${cas.version}</version>
<type>war</type>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId>
<version>1.0.b2</version>
<scope>provided</scope>
</dependency>
<!-- <dependency> <groupId>org.jasig.cas</groupId> <artifactId>cas-server-support-ldap</artifactId>
<version>${cas.version}</version> <exclusions> <exclusion> <artifactId>xml-apis</artifactId>
<groupId>xml-apis</groupId> </exclusion> <exclusion> <artifactId>opensaml</artifactId>
<groupId>org.opensaml</groupId> </exclusion> </exclusions> </dependency> -->
<dependency>
<groupId>org.jasig.cas</groupId>
<artifactId>cas-server-support-generic</artifactId>
<version>${cas.version}</version>
<type>jar</type>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.16</version>
<scope>runtime</scope>
</dependency>
</dependencies>
<properties>
<cas.version>3.5.2.1</cas.version>
</properties>
<repositories>
<repository>
<id>ja-sig</id>
<url>http://oss.sonatype.org/content/repositories/releases/ </url>
</repository>
</repositories>
</project>
weblogic.xml
<?xml version="1.0" encoding="UTF-8"?>
<wls:weblogic-web-app xmlns:wls="http://xmlns.oracle.com/weblogic/weblogic-web-app" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd http://xmlns.oracle.com/weblogic/weblogic-web-app http://xmlns.oracle.com/weblogic/weblogic-web-app/1.2/weblogic-web-app.xsd">
<wls:context-root>cas</wls:context-root>
<wls:weblogic-version>10.3.5.0</wls:weblogic-version>
<wls:container-descriptor>
<wls:prefer-application-packages>
<wls:package-name>javax.xml.parsers.SAXParserFactory</wls:package-name>
<wls:package-name>org.opensaml.*</wls:package-name>
</wls:prefer-application-packages>
</wls:container-descriptor>
</wls:weblogic-web-app>