title: CAS HTTP 401 - Authentication Failed: Bad credentials
body: <p>I have an error with Cas when i try login, i've self signed certificate and already add these to my keystore and and the keystore to the cacerts, i am using tomcat6 and maven to generated the .war, i have read others solutions to modify the code but none of these work in the code that i have
  thx for the help</p>
  
  <p>These is the log from CAS</p>
  
  <pre><code>ServiceValidateController [ERROR] TicketException generating ticket for: [callbackUrl: https://localhost:8443/receptor]
  org.jasig.cas.ticket.TicketCreationException: error.authentication.credentials.bad
      at org.jasig.cas.CentralAuthenticationServiceImpl.delegateTicketGrantingTicket(CentralAuthenticationServiceImpl.java:291)
      at org.jasig.cas.web.ServiceValidateController.handleRequestInternal(ServiceValidateController.java:126)
      at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
      at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
      at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:875)
      at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:807)
      at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:571)
      at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:501)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
      at org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      at org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
      at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
      at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
      at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
      at java.lang.Thread.run(Thread.java:722)
  Caused by: error.authentication.credentials.bad
      at org.jasig.cas.authentication.handler.BadCredentialsAuthenticationException.&lt;clinit&gt;(BadCredentialsAuthenticationException.java:25)
      at org.jasig.cas.authentication.AuthenticationManagerImpl.authenticate(AuthenticationManagerImpl.java:113)
      at org.jasig.cas.CentralAuthenticationServiceImpl.delegateTicketGrantingTicket(CentralAuthenticationServiceImpl.java:262)
      ... 26 more
  </code></pre>
  
  <p>These is the log from Ldap</p>
  
  <pre><code>geobolivia slapd[3024]: conn=1003 op=3 SRCH base="ou=users,dc=geobolivia,dc=gob,dc=bo" scope=2 deref=3 filter="(uid=geobolivia)"
  geobolivia slapd[3024]: conn=1003 op=3 SEARCH RESULT tag=101 err=0 nentries=0 text=
  geobolivia slapd[3024]: conn=1003 op=4 SRCH base="ou=users,dc=geobolivia,dc=gob,dc=bo" scope=2 deref=3 filter="(uid=_cas_stateful_)"
  geobolivia slapd[3024]: conn=1003 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text=
  </code></pre>
  
  <p>And these is the log from Security-proxy</p>
  
  <pre><code>ProxyGrantingTicketStorageImpl [INFO] No Proxy Ticket found for 
  FilterBasedLdapUserSearch [DEBUG] Searching for user 'geobolivia', with user search [ searchFilter: '(uid={0})', searchBase: 'ou=users', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
  AbstractContextSource [DEBUG] Got Ldap context on server 'ldap://localhost:389/dc=geobolivia,dc=gob,dc=bo'
  SpringSecurityLdapTemplate [DEBUG] Searching for entry in under DN 'dc=geobolivia,dc=gob,dc=bo', base = 'ou=users', filter = '(uid={0})'
  ProviderManager [DEBUG] Authentication attempt using org.springframework.security.ldap.authentication.LdapAuthenticationProvider
  LdapAuthenticationProvider [DEBUG] Processing authentication request for user: _cas_stateful_
  FilterBasedLdapUserSearch [DEBUG] Searching for user '_cas_stateful_', with user search [ searchFilter: '(uid={0})', searchBase: 'ou=users', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
  AbstractContextSource [DEBUG] Got Ldap context on server 'ldap://localhost:389/dc=geobolivia,dc=gob,dc=bo'
  SpringSecurityLdapTemplate [DEBUG] Searching for entry in under DN 'dc=geobolivia,dc=gob,dc=bo', base = 'ou=users', filter = '(uid={0})'
  2013-08-29 18:29:15 CasAuthenticationFilter [DEBUG] Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
  2013-08-29 18:29:15 CasAuthenticationFilter [DEBUG] Updated SecurityContextHolder to contain null Authentication
  CasAuthenticationFilter [DEBUG] Delegating to authentication failure handlerorg.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@1e6ba8ee
  SimpleUrlAuthenticationFailureHandler [DEBUG] No failure URL set, sending 401 Unauthorized error
  HttpSessionSecurityContextRepository [DEBUG] SecurityContext is empty or anonymous - context will not be stored in HttpSession. 
  SecurityContextPersistenceFilter [DEBUG] SecurityContextHolder now cleared, as request processing completed
  </code></pre>
  
  <p>The code of applicationContext-security.xml is these</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:p="http://www.springframework.org/schema/p"
      xmlns:s="http://www.springframework.org/schema/security"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
      &lt;bean id="properties-loader"
          class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"
          p:locations="/WEB-INF/security-proxy.properties" /&gt;
  
      &lt;s:http entry-point-ref="casProcessingFilterEntryPoint" path-type="regex"&gt;
          &lt;s:intercept-url pattern=".*\?.*login.*" access="ROLE_SV_USER,ROLE_SV_EDITOR,ROLE_SV_REVIEWER,ROLE_SV_ADMIN" /&gt;
          &lt;s:intercept-url pattern="/gssec/.*" access="ROLE_GS_ADMIN" /&gt;
          &lt;s:intercept-url pattern="/extractorapp/admin/.*" access="ROLE_ADMINISTRATOR,ROLE_SV_ADMIN" /&gt;
          &lt;s:intercept-url pattern="/analytics/.*" access="ROLE_ADMINISTRATOR,ROLE_SV_ADMIN,ROLE_STAT_USER" /&gt;
          &lt;s:intercept-url pattern="/test/.*" access="ROLE_GS_ADMIN" /&gt;
          &lt;s:intercept-url pattern="/testPage" access="IS_AUTHENTICATED_FULLY" /&gt;
  &lt;!--        &lt;sec:intercept-url pattern=".*\?.*login.*" access="IS_AUTHENTICATED_FULLY" /&gt;--&gt;
          &lt;s:intercept-url pattern=".*" access="IS_AUTHENTICATED_ANONYMOUSLY,ROLE_SV_USER,ROLE_SV_EDITOR,ROLE_SV_REVIEWER,ROLE_SV_ADMIN" /&gt;
          &lt;!-- s:form-login / --&gt;
          &lt;s:custom-filter ref="casFilter" after="CAS_FILTER" /&gt;
          &lt;s:http-basic/&gt;
          &lt;s:anonymous granted-authority="ROLE_ANONYMOUS"/&gt;
          &lt;s:logout logout-success-url="${logout-success-url}"/&gt;
          &lt;!-- Limits the number of concurrent sessions a user can have --&gt;
          &lt;!--&lt;sec:concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/&gt;--&gt;
  
      &lt;/s:http&gt;
  
      &lt;s:authentication-manager alias="authenticationManager"&gt;
          &lt;s:authentication-provider ref='casAuthenticationProvider' /&gt;
          &lt;s:authentication-provider ref='ldapAuthenticationProvider' /&gt;
      &lt;/s:authentication-manager&gt;
  
  
      &lt;!-- This bean points at the embedded directory server created by the ldap-server element above  --&gt;
      &lt;bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"&gt;
          &lt;constructor-arg value="${ldapUrl}/${baseDN}"/&gt;
          &lt;property name="userDn" value="${ldapAdminDn}" /&gt;
          &lt;property name="password" value="${ldap.admin.password}" /&gt;
          &lt;property name="baseEnvironmentProperties"&gt;
              &lt;map&gt;
                  &lt;entry&gt;
                      &lt;key&gt;
                          &lt;value&gt;java.naming.security.authentication&lt;/value&gt;
                    &lt;/key&gt;
                      &lt;value&gt;simple&lt;/value&gt;
                    &lt;/entry&gt;
               &lt;/map&gt;
           &lt;/property&gt;
       &lt;/bean&gt;
  
      &lt;bean id="ldapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch"&gt;
          &lt;constructor-arg index="0" value="${userSearchBaseDN}"/&gt;
          &lt;constructor-arg index="1" value="${userSearchFilter}"/&gt;
          &lt;constructor-arg index="2" ref="contextSource" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="ldapAuthoritiesPopulator" class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"&gt;
          &lt;constructor-arg ref="contextSource" /&gt;
          &lt;constructor-arg value="${authoritiesBaseDN}" /&gt;
          &lt;property name="groupSearchFilter" value="${groupSearchFilter}"/&gt;
          &lt;property name="rolePrefix" value="ROLE_"/&gt;
          &lt;property name="searchSubtree" value="true"/&gt;
          &lt;property name="convertToUpperCase" value="true"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="ldapAuthenticationProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"&gt;
          &lt;constructor-arg&gt;
              &lt;bean class="org.springframework.security.ldap.authentication.BindAuthenticator"&gt;
                  &lt;constructor-arg ref="contextSource" /&gt;
                  &lt;property name="userSearch" ref="ldapUserSearch"/&gt;
              &lt;/bean&gt;
          &lt;/constructor-arg&gt;
          &lt;constructor-arg ref="ldapAuthoritiesPopulator" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userService" class="org.springframework.security.ldap.userdetails.LdapUserDetailsService"&gt;
          &lt;constructor-arg index="0" ref="ldapUserSearch" /&gt;
          &lt;constructor-arg index="1" ref="ldapAuthoritiesPopulator" /&gt;
      &lt;/bean&gt;
  
      &lt;!-- start cas config --&gt;
      &lt;bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter"&gt;
  
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;property name="authenticationFailureHandler"&gt;
              &lt;bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"&gt;
                  &lt;property name="defaultFailureUrl" value="/casfailed.jsp"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
          &lt;property name="authenticationSuccessHandler"&gt;
              &lt;bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"&gt;
                  &lt;property name="defaultTargetUrl" value="/"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
  
  &lt;!--        &lt;property name="useRelativeContext" value="true" /&gt;--&gt;
          &lt;property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" /&gt;
          &lt;property name="proxyReceptorUrl" value="/receptor" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="casFilter"
        class="org.springframework.security.cas.web.CasAuthenticationFilter"&gt;
        &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="casProcessingFilterEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"&gt;
          &lt;property name="loginUrl" value="${casLoginUrl}"/&gt;
          &lt;property name="serviceProperties" ref="serviceProperties"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="casAuthenticationProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider"&gt;
          &lt;property name="userDetailsService" ref="userService" /&gt;
          &lt;property name="serviceProperties" ref="serviceProperties" /&gt;
          &lt;property name="ticketValidator"&gt;
          &lt;bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"&gt;
                          &lt;constructor-arg index="0" value="${casTicketValidation}" /&gt;
                          &lt;property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" /&gt;
                          &lt;property name="proxyCallbackUrl" value="${casCallbackUrl}" /&gt;
              &lt;/bean&gt;
      &lt;/property&gt;
          &lt;property name="key" value="security-proxy"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="proxyGrantingTicketStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl"&gt;
        &lt;constructor-arg index="0" value="7200000" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties"&gt;
          &lt;property name="service" value="${proxyCallback}"/&gt;
          &lt;property name="sendRenew" value="false"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- end cas config --&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>and the code from security-proxy.properties is the next</p>
  
  <pre><code># ------   proxy-servlet.xml   ---------
  proxy.defaultTarget=http://localhost:8080
  
  public.host=geobolivia.gob.bo
  
  # -------  applicationContext-security.xml   -------
  anonymousRole=ROLE_ANONYMOUS
  proxy.contextPath=/sec
  # url called when user has logged out
  logout-success-url=https://geobolivia.gob.bo:443/cas/logout?fromgeorchestra
  # url where the user can login
  casLoginUrl=https://geobolivia.gob.bo:443/cas/login
  #url that the security system uses to validate the cas tickets
  casTicketValidation=https://localhost:8443/cas
  # URL for cas to verify the incoming request
  casCallbackUrl=https://localhost:8443/receptor
  # After going to the cas login cas forwards to this URL where the authorities and permissions are checked
  proxyCallback=https://geobolivia.gob.bo:443/j_spring_cas_security_check
  # the ldap url
  ldapUrl=ldap://localhost:389
  baseDN=dc=geobolivia,dc=gob,dc=bo
  # The base DN from where to search for the logged in user.  This mostly to verify the user exists
  userSearchBaseDN=ou=users
  # the second part of looking up the user
  userSearchFilter=(uid={0})
  # The base DN to use for looking up the roles/groups/authorities of the logged in user.  Normally the ldap is configured like:
  #   ou=groups
  #       ou=somegroup
  #           member=username
  # 
  #   ou can be cn, ou, or some other option.  member is often uniquemember as well.  If you don't know what this means you need to
  #   research LDAP
  authoritiesBaseDN=ou=groups
  # The attribute of the group which is the rolename
  groupRoleAttribute=cn
  # the search filter that selects the groups that the user is part of. 
  # If a match is found the containing object is one of the groups the user is part of
  groupSearchFilter=(memberUid=uid={1},ou=users,dc=geobolivia,dc=gob,dc=bo)
  # the admin user's DN (distinguished name) 
  #    Depending on how the LDAP is configured you may be able to comment this and password out and add
  #       &lt;property name="anonymousReadOnly" value="true" /&gt;
  #    to the "ldapContextSource" bean
  ldapAdminDn=cn=admin,dc=geobolivia,dc=gob,dc=bo
  # The password for binding to the admin user in the ldap
  ldap.admin.password=geobolivia
  
  # health check properties
  #checkHealth=false
  checkHealth=true
  psql.host=${shared.psql.host}
  psql.port=${shared.psql.port}
  psql.db=${shared.psql.geonetwork.db}
  psql.user=${shared.psql.user}
  psql.pass=${shared.psql.pass}
  psql.url=${shared.psql.url}
  max.database.connections=170
  </code></pre>