apache / apache/grails-core

ERR_TOO_MANY_REDIRECTS with cas login when web-app is deployed with context path in aks

Open
#15,918 0 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

We had grails 4 app which we recently upgraded to grails 6. This app uses CAS for login and the app works fine when running locally. However when we deploy this app to AKS, we add context path(sonic) to access the service since we have multiple web applications running under same host name.

When we browse the app, it correctly redirects to CAS login page and after logging in, the url address change from :

https:[HOST]/sonic/login/cas?ticket=[SERVICE TICKET]

and then to to

https:[CAS server]/cas/login?service=https%3A%2F%2F[HOST]%2Fsonic%2Flogin%2Fcas

with error message:

```
This page isn’t working
[HOST] redirected you too many times.
Try deleting your cookies.
ERR_TOO_MANY_REDIRECTS
```

This issue however was not happening with old (grails 4) code, so it makes me believe that when we upgraded the spring security library for grails 6, there must be something we have missed. But its been really difficult to track since this is only happening in aks and cannot be reproduced locally(with/without context path).

These are the spring security plugins used in the web app:

```
implementation("org.grails.plugins:spring-security-cas:4.0.0")
implementation("org.grails.plugins:spring-security-core:6.0.3")
implementation("org.grails.plugins:spring-security-rest:3.0.1")
```

And the cas configs are:

```
grails:
plugin:
springsecurity:
cas:
loginUri: "/login"
serviceUrl: "${SONIC_APPLICATION_URL}/login/cas"
serverUrlPrefix: "${SONIC_CAS_URL}"
useSingleSignout: true
filterProcessesUrl: '/login/cas'
whiteListAlgorithms: 'RS256,RS512'
```

UPDATE:

when enabling debug logs I see:

```
2024-05-10 15:53:08.694 [http-nio-8080-exec-36] DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Failed to authorize filter invocation [GET /sonic/login/cas?ticket=ST-5981-YBdk3BekFB1U4uPo-1OHKCYhBA0-cas-deployment-558466988-9kj4b] with attributes [ROLE_CONCEPT_ARCHIVE]
```
Asked the same here as well : https://stackoverflow.com/questions/78443531/err-too-many-redirects-with-cas-login-when-web-app-is-deployed-with-context-path

Contributor guide

Open the contributing guide

Research direction

Start with the spring-security-cas, spring-security-core, and spring-security-rest configuration, especially the CAS URLs and the FilterSecurityInterceptor debug entry for GET /sonic/login/cas. Compare the Grails 4 and Grails 6 behavior in an AKS deployment with the /sonic context path; done means CAS login completes without the redirect loop and the ticket request is authorized.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, groovy, kubernetes, spring
Domain
authentication, backend, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.