<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-155fb27f-2481-4e63-be75-46659157b1dd" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="henson@cpp.edu" id="email_henson@cpp.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=henson%40cpp.edu" style="color:#0052cc;; color: #3b73af; text-decoration: none">Paul B. Henson</a> <strong>created</strong> an issue </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"> <a href="https://issues.shibboleth.net/jira/browse/IDP" style="color: #3b73af; text-decoration: none">Identity Provider</a> / <a href="https://issues.shibboleth.net/jira/browse/IDP-1657" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-0ee319fe-88d3-4814-a005-3b28a67a799b" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://issues.shibboleth.net/jira/browse/IDP-1657" style="color: #3b73af; text-decoration: none">IDP-1657</a> </td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1657" style="color: #3b73af; text-decoration: none">CAS proxy validation failure - Configured TLS trust engine was not used</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-avatar-0ee319fe-88d3-4814-a005-3b28a67a799b" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Affects Versions:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 4.0.1 </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="serac@vt.edu" id="email_serac@vt.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=serac%40vt.edu" style="color:#0052cc;; color: #3b73af; text-decoration: none">Marvin S Addison</a> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Components:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> CAS </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 18/Aug/20 12:45 AM </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Environment:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0; margin-top: 0">CentOS Linux release 8.1.1911 (Core)</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">openjdk 11.0.6 2020-01-14 LTS<br> OpenJDK Runtime Environment 18.9 (build 11.0.6+10-LTS)<br> OpenJDK 64-Bit Server VM 18.9 (build 11.0.6+10-LTS, mixed mode, sharing)</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">jetty-bin-9.4.31.v20200723-1.noarch</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </p> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-static-major-3f60b580-43c5-48a8-8c38-3098bb5ea79c" height="16" width="16" border="0" align="absmiddle" alt="Major" style="vertical-align: text-bottom"> Major </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="henson@cpp.edu" id="email_henson@cpp.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=henson%40cpp.edu" style="color:#0052cc;; color: #3b73af; text-decoration: none">Paul B. Henson</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0; margin-top: 0">CAS proxy callback validation seems to work only once every 10 minutes. The first attempt works fine:</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2020-08-16 20:13:07,435 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - INFO <br> <span class="error">[net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:153]</span> - Profile Action <br> ValidateTicketAction: Successfully validated <br> ST-AADXGZLDOJSXIMPCXDWYYTI3TYSIZNNR5NVOYQ7L4MN2B7SP4SNLTIKY3ZMDVJJWIDZ66OISNE7X3<br> O5VPSPPATZRC3BVXDMRDOCSY7RS5WTX6CFEKHGO7TS3EHANWCENLNQG76UJUZNELW6WSJNTJ2NA3SGJK<br> P3CUKHOBS5EQYTVWCSNKJBMEYSKEHH5ESVS4Z3AXYYK42CJKLHKY3SJTBPPCWMI5EUHJTAGX3HHXUM4S<br> SBD62LMBKTHMNY4WCBZLV4MYETY7ROYTF5254UYMESLUF4CHPPMPZKSLTKQZLVJTTY3VNGWX3TMJL4TC<br> ZQL3DMBATAN3EJ2XAW5LN62LYMBLQM7Y6KXRK44RZQCTUYEPRJKGSKJS6M4FAKA---- for <br> <a href="https://www.idm.unx.cpp.edu/webui-dev" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/webui-dev</a> <br> 2020-08-16 20:13:07,441 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> <span class="error">[net.shibboleth.idp.cas.flow.impl.ValidateProxyCallbackAction:159]</span> - Profile <br> Action ValidateProxyCallbackAction: Attempting proxy authentication to <br> <a href="https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597633987438-RimfopY1FUF9y1MS" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597633987438-RimfopY1FUF9y1MS</a><br> Uwjd5E4EM4rJq0KImM94M22Dekq0HbsSvT&pgtIou=PGTIOU-1597633987441-AWOqUCZFoKlTj5C7Q<br> gD2OwVKBF8wFmpUaBEe3MjdHLOrdQl8Sk <br> 2020-08-16 20:13:07,442 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> <span class="error">[net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator:162]</span> - Attempting to<br> validate CAS proxy callback URI <br> <a href="https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597633987438-RimfopY1FUF9y1MS" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597633987438-RimfopY1FUF9y1MS</a><br> Uwjd5E4EM4rJq0KImM94M22Dekq0HbsSvT&pgtIou=PGTIOU-1597633987441-AWOqUCZFoKlTj5C7Q<br> gD2OwVKBF8wFmpUaBEe3MjdHLOrdQl8Sk <br> 2020-08-16 20:13:07,456 - 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> <span class="error">[org.opensaml.saml.security.impl.MetadataCredentialResolver:285]</span> - Resolving <br> credentials from metadata using entityID: <a href="https://www.idm.unx.cpp.edu/" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/</a>, role: </p> {urn:oasis:names:tc:SAML:2.0:metadata} <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">SPSSODescriptor, protocol: <br> <a href="https://www.apereo.org/cas/protocol" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.apereo.org/cas/protocol</a>, usage: SIGNING <br> 2020-08-16 20:13:07,456 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> <span class="error">[org.opensaml.saml.security.impl.MetadataCredentialResolver:434]</span> - Retrieving <br> role descriptor metadata for entity 'https://www.idm.unx.cpp.edu/' in role <br> '{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol <br> 'https://www.apereo.org/cas/protocol' <br> olver.impl.AbstractBatchMetadataResolver:178] - Metadata Resolver <br> FilesystemMetadataResolver cpp-cas: Resolved 1 c <br> andidates via EntityIdCriterion: EntityIdCriterion <br> <span class="error">[id=https://www.idm.unx.cpp.edu/]</span> <br> 2020-08-16 20:13:07,460 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> [org.opensaml.saml.metada <br> ta.resolver.impl.AbstractMetadataResolver:610] - Metadata Resolver <br> FilesystemMetadataResolver cpp-cas: Attempting to fil <br> ter candidate EntityDescriptors via resolved Predicates <br> 2020-08-16 20:13:07,460 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> [org.opensaml.saml.metada <br> ta.resolver.impl.AbstractMetadataResolver:632] - Metadata Resolver <br> FilesystemMetadataResolver cpp-cas: After predicate filtering 1 <br> EntityDescriptors remain <br> 2020-08-16 20:13:07,500 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <span class="error">[net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:179]</span> - Storing mapping<br> of PGT-1597633987438-RimfopY1FUF9y1MSUwjd5E4EM4rJq0KImM94M22Dekq0HbsSvT to <br> 04e5585eeb8b0fb39cc59214aa90122cc066ddf9effde81253465458eafb5fbd in context <br> <a href="https://www.apereo.org/cas/protocol/serviceValidate" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.apereo.org/cas/protocol/serviceValidate</a> <br> 2020-08-16 20:13:07,501 - <br> 2620:df:8000:ff10:0:1:247:16/node0np5dpf62x7qd1xpq7vzwncvwi1 - DEBUG <br> <span class="error">[net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:183]</span> - Storing <br> PGT-1597633987438-RimfopY1FUF9y1MSUwjd5E4EM4rJq0KImM94M22Dekq0HbsSvT in context <br> 04e5585eeb8b0fb39cc59214aa90122cc066ddf9effde81253465458eafb5fbd </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">A subsequent attempt fails:</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2020-08-16 20:14:56,646 - <br> 2620:df:8000:ff10:0:1:247:16/node01pf4gxx0vbayfq9f6avlhfaxu2 - INFO <br> [net.shibboleth.idp.cas.fl <br> ow.impl.ValidateTicketAction:153] - Profile Action ValidateTicketAction: <br> Successfully validated ST-AADXGZLDOJSXIMIXKFELT <br> Y3E7JWSD2TLC5AVKPSRU3QNMI2GPRPQ6TI25AYYZK56C7GHVNWE3XT4GFJN56KZ5CSB2J47LUEWFZBRA<br> Y6FJOARPNPUNTUIWV2WP5APZ4E67ZHWUCRKQI5HQ <br> BCMGTMO7R5ERXHQBCY47W6S33E2HPVZU6GMZIS4YSSFTIV57OGAP7CF3HJFKW5CDZAHYODA26I74NGDQ<br> BWY2OGNU2NYCGQWOGMBKQR6TF6KO2WCZB53EAVXZ <br> BBH6CXBFPIIBE54WNXRINMCFTDB2YCZEAIVSKOTK5XFFN3H5QXRHY7RVC6AIG5EGYYBRLACDQD46E3OR<br> AOUBGD4HGOL4UPUNARYCI2XFQ7PUAXFCVFVZBZQ- <br> — for <a href="https://www.idm.unx.cpp.edu/webui-dev" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/webui-dev</a> <br> 2020-08-16 20:14:56,647 - <br> 2620:df:8000:ff10:0:1:247:16/node01pf4gxx0vbayfq9f6avlhfaxu2 - DEBUG <br> [net.shibboleth.idp.cas.f <br> low.impl.ValidateProxyCallbackAction:159] - Profile Action <br> ValidateProxyCallbackAction: Attempting proxy authentication <br> to <br> <a href="https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597634096647-2G7mZZANKA9j6GHz" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597634096647-2G7mZZANKA9j6GHz</a><br> cyIyr1lJp92DwuhUB3PiTJPonGFDtMLb9w&pg <br> tIou=PGTIOU-1597634096647-WG3okNIyBA7UN42qCQMArT8TKlHSn8JsXghTscSeVN6kBAWGdf <br> 2020-08-16 20:14:56,648 - <br> 2620:df:8000:ff10:0:1:247:16/node01pf4gxx0vbayfq9f6avlhfaxu2 - DEBUG <br> <span class="error">[net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator:162]</span> - Attempting to<br> validate CAS proxy callback URI <br> <a href="https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597634096647-2G7mZZANKA9j6GHz" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/cas_pgt-dev?pgtId=PGT-1597634096647-2G7mZZANKA9j6GHz</a><br> cyIyr1lJp92DwuhUB3PiTJPonGFDtMLb9w&pgtIou=PGTIOU-1597634096647-WG3okNIyBA7UN42qC<br> QMArT8TKlHSn8JsXghTscSeVN6kBAWGdf <br> 2020-08-16 20:14:56,680 - <br> 2620:df:8000:ff10:0:1:247:16/node01pf4gxx0vbayfq9f6avlhfaxu2 - WARN <span class="error">[org.opensaml.security.httpclient.HttpClientSecuritySupport:109]</span> - Configured <br> TLS trust engine was not used to verify server TLS credential, the appropriate <br> socket factory was likely not configured <br> 2020-08-16 20:14:56,683 - <br> 2620:df:8000:ff10:0:1:247:16/node01pf4gxx0vbayfq9f6avlhfaxu2 - WARN <br> <span class="error">[net.shibboleth.idp.cas.flow.impl.ValidateProxyCallbackAction:170]</span> - Profile <br> Action ValidateProxyCallbackAction: Proxy authentication failed for <br> <a href="https://www.idm.unx.cpp.edu/cas_pgt-dev" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/cas_pgt-dev</a> <br> javax.security.auth.login.CredentialException: Untrusted certificate presented <br> by CAS proxy callback endpoint </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">If 10 minutes go by without making a a request, the callback succeeds again, once, then fails again until no calls are made for 10 minutes.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">This failure is distinct from an actual cert mismatch, which looks like:</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2020-08-17 11:39:06,675 - 2620:df:8000:ff10:0:1:247:16 - ERROR <br> <span class="error">[org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:297]</span> - <br> Credential failed name check: [subjectName='CN=idm.unx.cpp.edu,OU=CSU <br> Pomona,O=California State Polytechnic University\, Pomona,STREET=3801 West <br> Temple Avenue,L=Pomona,ST=CA,2.5.4.17=#13053931373638,C=US'] <br> 2020-08-17 11:39:06,684 - 2620:df:8000:ff10:0:1:247:16 - WARN <br> <span class="error">[net.shibboleth.idp.cas.flow.impl.ValidateProxyCallbackAction:170]</span> - Profile <br> Action ValidateProxyCallbackAction: Proxy authentication failed for <br> <a href="https://www.idm.unx.cpp.edu/cas_pgt-dev" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.idm.unx.cpp.edu/cas_pgt-dev</a> <br> java.security.cert.CertificateException: Trust engine could not establish trust <br> of presented TLS credential <br> at <br> org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustManager.performTrustEval<br> (ThreadLocalX509TrustManager.java:93)</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">Also, with an actual cert mismatch no request is logged on the CAS proxy client access log. When the call fails with "Configured TLS trust engine was not used", there is an entry on the CAS proxy client access log. It appears that the actual callback request is made successfully, but that it thinks it wasn't validated.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">This is very strange. I restarted with a fresh stock config and updated just the bare minimum to be able to successfully auth and have CAS metadata and it still happens.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1657#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-4b0c1597-058c-49d9-9eae-cbe24f214663" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1657#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v8.5.4#805004-<span title="0444eab799707f9ad7b248d69f858774aadfd250" data-commit-id="0444eab799707f9ad7b248d69f858774aadfd250}">sha1:0444eab</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="https://issues.shibboleth.net/jira/images/mail/atlassian-email-logo.png" alt="Atlassian logo" title="Atlassian logo" width="191" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>