IdP v3.0.0 CAS Support

[Marvin Addison]

>
> 1:  Some servlet containers attempt to do URL-based session management
> until a cookie is received back from the browser.  This causes the CAS
> service URL to vary between login and validation.
>
> The result is the following error and an INVALID_SERVICE message being
> sent to the client.
>

Please file an issue for this. While the URI specification is pretty clear
that two URIs that differ in path parameters are in fact distinct, the
jsessionid case is common enough that it should at least be configurable
and probably the default.

2. Some older CAS clients don’t properly parse SOAP messages....

The assumption here is that a specific XML namespace prefix will always
> appear.  This is obviously a client bug


Indeed. The good news is that the bug was fixed over two years ago, and
there are a number of improvements and security fixes that have happened
since. Upgrading to 3.3.x is the sensible thing to do.


> it does seem to be the case that the Jasig CAS Server has always used the
> same prefix


For a long time yes, but changed around the same time as related client
fix. See https://issues.jasig.org/browse/CAS-951.


> 3. This is more of a feature proposal, but it sure would be nice if the
> ServiceRegistry was a ReloadableSpringService.
>

Excellent suggestion. Please file an issue for that.

I sincerely appreciate your testing and feedback.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150215/b16a529c/attachment.html