[JIRA] (IDP-2010) ticketValidityPeriod for CAS PGTs is abnormally short by default

[Maxime Besson (Jira)]

Maxime Besson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=632ca15b748d1bfcb85792a9 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiYzkwMjEzMzNkZjRmNDJjNjkzMWUyNWQyNjAwMmUxODYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-2010?atlOrigin=eyJpIjoiYzkwMjEzMzNkZjRmNDJjNjkzMWUyNWQyNjAwMmUxODYiLCJwIjoiaiJ9 ) IDP-2010 ( https://shibboleth.atlassian.net/browse/IDP-2010?atlOrigin=eyJpIjoiYzkwMjEzMzNkZjRmNDJjNjkzMWUyNWQyNjAwMmUxODYiLCJwIjoiaiJ9 ) ticketValidityPeriod for CAS PGTs is abnormally short by default ( https://shibboleth.atlassian.net/browse/IDP-2010?atlOrigin=eyJpIjoiYzkwMjEzMzNkZjRmNDJjNjkzMWUyNWQyNjAwMmUxODYiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.2.1 Assignee: Unassigned Components: CAS Created: 22/Sep/22 2:30 PM Priority: Trivial Reporter: Maxime Besson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=632ca15b748d1bfcb85792a9 )

While testing the CAS protocol in proxy mode I found out that PGTs have an extremely short lifespan of 15 seconds, which is also the default lifetime of STs and PTs

PGTs are meant to be reused ( https://apereo.github.io/cas/development/protocol/CAS-Protocol-V2-Specification.html#33-proxy-granting-ticket ( https://apereo.github.io/cas/development/protocol/CAS-Protocol-V2-Specification.html#33-proxy-granting-ticket ) 3.3.1) and usually last about as long as the CAS session itself, depending on the CAS implementation ( https://github.com/apereo/cas/blob/4ac748296a4b8f4dda3b62eaa9a17e78ff2a7180/core/cas-server-core-tickets-api/src/main/java/org/apereo/cas/ticket/factory/DefaultProxyGrantingTicketFactory.java#L124 ( https://github.com/apereo/cas/blob/4ac748296a4b8f4dda3b62eaa9a17e78ff2a7180/core/cas-server-core-tickets-api/src/main/java/org/apereo/cas/ticket/factory/DefaultProxyGrantingTicketFactory.java#L124 ) )

This seems to be unintentional, as this ( https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java;h=f1e61ccb207745ef0be3ab46ee6e3bbcdfa30684;hb=HEAD#l77 ) comment suggests the default TTL used to be 12 hours, while the constant is set to 15 seconds ( https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java;h=f1e61ccb207745ef0be3ab46ee6e3bbcdfa30684;hb=HEAD#l52 )

The issue is easy to solve in configuration:

<bean parent="CAS.ValidateConfiguration" p:ticketValidityPeriod="PT12H"/>

But there is no such example in IDP4 docs, and it’s a bit puzzling to new users

( https://shibboleth.atlassian.net/browse/IDP-2010#add-comment?atlOrigin=eyJpIjoiYzkwMjEzMzNkZjRmNDJjNjkzMWUyNWQyNjAwMmUxODYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2010#add-comment?atlOrigin=eyJpIjoiYzkwMjEzMzNkZjRmNDJjNjkzMWUyNWQyNjAwMmUxODYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100207- sha1:a65942b )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220922/e41ceb20/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-2b3771dd-4e74-4ce2-b8ce-3973cdff5eec
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220922/e41ceb20/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-a4e0f6d5-88a6-4677-b283-401277cca361
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220922/e41ceb20/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-cabcaafd-2273-41cd-a946-627464a6c000
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220922/e41ceb20/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-581dacfa-10f3-4fe3-a800-93878b80e5dc
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220922/e41ceb20/attachment-0007.png>