Search code examples
ldapcasjasig

Jasig CAS: page reloads on 5th attempt to login

There is CAS+LDAP authorization system.

My login page reloads on 5th wrong attempt to login. For example, if I try to login with wrong password from 1 to 4 times, only password field cleared. On 5th attempt page reloads (even if password is right) and both username and password fields cleared.

And there is no log output neither in CAS nor in LDAP at this moment.

I have spent two weeks in search for solution, but nothing found.

Thank for advance.

P.S. Sorry for my english :)

---------- EDIT ----------

After Ioannis Baourdos' answer:

  1. The hidden field name="execution" with value="${flowExecutionKey}" presents in my custom casLoginView.jsp

  2. I have also checked my log on 5th attempt. Here I see the same output if I reload page manually.

  3. In my web-browser I repeatedly checked name="execution" value. Here the values:

Action -> Value

1) opened page -> e1s1

2) 1st wrong attempt -> e1s2

3) 2nd wrong attempt -> e1s3

4) 3rd wrong attempt -> e1s4

5) 4th wrong attempt -> e1s5

6) Next either right or wrong attempt (page reloads after submit) -> e7s1

Logically somewhere there is some parameter with value "5". I have not found it yet...

Question is still open ;)

---------- SOLVED ----------

There was link to not existing .png file in my custom css.

Solution

  • More on Suggestion (2)

    I was searching for a 5 parameter all over the place myself. I then reverted back to using the default UI/theme from jasig and the redirection was not happening. So in my case I was 100% certain that there was something wrong with my code.

    I left it as it was, went on production and then I had a new CAS integration case which again was implemented with a different custom form.

    The 5 became 2 ... same version etc etc. So I jumped into tamper data on firefox to see exactly what was happening.

    In the first case it was a custom CSS I was using, that was trying to load another CSS that did not exist.

    In the second case, I had upgraded JQuery to 1.10 and I placed the script tag at /includes/top.jsp. I also did not include the /jsp/cas.js file.

    With firebug I noticed that this JS file was asking for @sourceMappingURL=jquery-1.10.2.min.map

    which was missing from my JS folder.

    to cut a long story short, when I moved my JS inclusions at the bottom.jsp in the same order as CAS default UI and after I removed / fixed all the related imports/includes from my custom JS/CSS files, the issue stopped.

    -- old -- if you are designing you custom login form there may be a view cases that cause the redirect.

    new suggestion (1)

    there are a few cases when this is happening. If you enable logging you may notice this popping up after the 5fth time: 'initialFlowSetupAction'

    in this case most frequent issue is that you are using a custom form and you forgot to set up the 'flow' hidden field.

    <input type="hidden" name="_flowExecutionKey" value="${flowExecutionKey}" />

    or on 3.5.2

    <input type="hidden" name="execution" value="${flowExecutionKey}" />

    new suggestion (2)

    I also run into a weird case lately ... I was using a custom CSS which was properly loaded BUT it contained imports to files that were missing: @import url(ui.datepicker.css);

    this was also evident via TamperData (2 calls to cas/login) and also via firebug, 302 redirect to cas/login from request for ui.datepicker.css

    ps. this is my first post :)