how to decode/encode CAS tickets across HTTP requests ?

[Tom Zeller]

Mostly Marvin,

TL;DR Dumb question : how should the CAS ticket be retrieved from an HTTP request via Java ?

I ask because some CAS tests[1] were failing due to the difference between the following :

ST-AAdzZWNyZXQyZixTFItOzysDQA+i1wYkOUqD4ME5uIpKvL0P2yx15V/XLIZMv4cfnu9GfZzJherEt1eX2pJcIg8OfeLJrVmV6cqrmZFb0+buuTHwGX2nbozbycd8mW6zXzkPgXrRUrIw+Y28nm9NK9qHtowwB2kItRwDtD+L/v4LnC4Ugx3kFov1Aly55HtRbsbpZwKzHXnIkila1dkb4j33iYAK+HxFzhYaHthLxKXFT4l6cAb9gnDphnbN1sDAOjgfF0X2uzcOYbmWq/QhgNm9HxSo6Okqc11oOotgJX5Rv7dV4yUlEZ0TC18jtEbamI0mIw==

and

ST-AAdzZWNyZXQyZixTFItOzysDQA i1wYkOUqD4ME5uIpKvL0P2yx15V/XLIZMv4cfnu9GfZzJherEt1eX2pJcIg8OfeLJrVmV6cqrmZFb0 buuTHwGX2nbozbycd8mW6zXzkPgXrRUrIw Y28nm9NK9qHtowwB2kItRwDtD L/v4LnC4Ugx3kFov1Aly55HtRbsbpZwKzHXnIkila1dkb4j33iYAK HxFzhYaHthLxKXFT4l6cAb9gnDphnbN1sDAOjgfF0X2uzcOYbmWq/QhgNm9HxSo6Okqc11oOotgJX5Rv7dV4yUlEZ0TC18jtEbamI0mIw==

As you can see, the “+” in the first has been replaced by a “ “ in the second. As these are encoded CAS tickets, the difference matters.

Deal is, calling HttpServletRequest.getParameter() returns the latter (the wrong one with the “ “). What I need, I think, is a version of java-support’s URISupport.parseQueryString() which does not URL decode query string params, but I thought I’d ask first.

The issue came up, I think, because the EncodingTicketService introduced characters into the ticket via the DataSealer that my horrible CAS “client” hadn’t seen before.

Thx,
Tom

[1] https://build.shibboleth.net/jenkins/job/java-idp-integration-tests/ws/test-distributions/20160826-22275202/logs/idp-process.log/*view*/