[java-idp-testbed] branch main updated: Improve the CAS testbed client to expose URL issues.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-testbed.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-testbed/commit/3ac5d3e7f163fcfb8d086e6c855c93adfad5b431

The following commit(s) were added to refs/heads/main by this push:
     new 3ac5d3e  Improve the CAS testbed client to expose URL issues.
3ac5d3e is described below

commit 3ac5d3e7f163fcfb8d086e6c855c93adfad5b431
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 8 12:57:42 2026 -0500

    Improve the CAS testbed client to expose URL issues.
---
 src/main/java/sp/CASController.java | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/src/main/java/sp/CASController.java b/src/main/java/sp/CASController.java
index 5c66f55..d18cfad 100644
--- a/src/main/java/sp/CASController.java
+++ b/src/main/java/sp/CASController.java
@@ -44,7 +44,7 @@ public class CASController {
 
     public String idpCASEndpointPath = "/idp/profile/cas";
 
-    public String casSPServicePath = "/sp/CAS/Service?foo=bar&baf=baz";
+    public String casSPServicePath = "/sp/CAS/Service?foo=bar&baf=baz%20boo";
 
     /**
      * Init SSO by redirecting to the CAS login service.
@@ -65,7 +65,7 @@ public class CASController {
 
         final List<Pair<String, String>> queryParams = urlBuilder.getQueryParams();
 
-        queryParams.add(new Pair<String, String>(ProtocolParam.Method.id(), "post"));
+        //queryParams.add(new Pair<String, String>(ProtocolParam.Method.id(), "post"));
         queryParams.add(new Pair<String, String>(ProtocolParam.Service.id(), baseUrl + casSPServicePath));
 
         final String redirectURL = urlBuilder.buildURL();
@@ -162,15 +162,26 @@ public class CASController {
 
             return new ResponseEntity<>(html, headers, HttpStatus.FORBIDDEN);
         }
-
+        
         final String baseUrl = getBaseUrl(servletRequest);
-
         final String endpointURL = baseUrl + idpCASEndpointPath + "/serviceValidate";
 
+        // Emulate a CAS client by determining "our" URL and removing the ticket parameter by hand.
+        // This isn't robust but it handles the cases being tested because the parameter is either alone
+        // or at the end. I have no earthly idea how this was expected to be implemented for real.
+        final StringBuffer requestURL = servletRequest.getRequestURL();
+        final String query = servletRequest.getQueryString();
+        if (query != null && !query.startsWith("ticket=")) {
+            final int index = query.indexOf("&ticket=");
+            if (index > 0) {
+                requestURL.append('?').append(query.substring(0, index));
+            }
+        }
+        
         final URLBuilder urlBuilder = new URLBuilder(endpointURL);
 
         final List<Pair<String, String>> queryParams = urlBuilder.getQueryParams();
-        queryParams.add(new Pair<String, String>(ProtocolParam.Service.id(), baseUrl + casSPServicePath));
+        queryParams.add(new Pair<String, String>(ProtocolParam.Service.id(), requestURL.toString()));
         queryParams.add(new Pair<String, String>(ProtocolParam.Ticket.id(), ticket));
 
         final String redirectURL = urlBuilder.buildURL();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.