Handler dropping port from service url passed by CAS Auth Filter

[Mackay, Rob]

When running the IDP on non-standard SSL ports (444) and CAS on non-standard ports (8447) the login handler appears to be using a server url without a port defined when forwarding to the CAS webapp.



Where is the service value for the CAS redirect defined, is it constructed from a non-property based location or is part of the configuration somewhere ?



As you can see from the following fiddler logs the SP has successfully redirected to the 444 port where the IDP is running, several redirects later it is still operating on the 444 port until it hits the CAS redirect at the third entry below. The service url passed to CAS does not contain the 444 SSL port for shib and is failing on login at this point.



If the system is configured with the SSL port for Shib using the default 443 it works without issue.



If the entry below is modified like the following line it works as expected
GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser

302 Redirect to https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%3A444%2Fidp%2FAuthn%2FRemoteUser



I have been unable to find a way to instruct the handler to use the port when constructing this url.



Fiddler log -------

POST https://testlp5.ellucian.com:444/idp/profile/SAML2/POST/SSO

302 Redirect to https://testlp5.ellucian.com:444/idp/AuthnEngine



GET https://testlp5.ellucian.com:444/idp/AuthnEngine

302 Redirect to https://testlp5.ellucian.com:444/idp/Authn/RemoteUser



GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser

302 Redirect to https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser



CONNECT http://testlp5.ellucian.com:8447

200 Connection Established ()



CONNECT http://testlp5.ellucian.com:8447

200 Connection Established ()



GET https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser

302 Redirect to https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com



CONNECT http://testlp5.ellucian.com:443

200 Connection Established ()



CONNECT http://testlp5.ellucian.com:443

200 Connection Established ()



GET https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com

404 Not Found (text/html)



CONNECT http://testlp5.ellucian.com:443

200 Connection Established ()



CONNECT http://testlp5.ellucian.com:443

200 Connection Established ()



GET https://testlp5.ellucian.com/html/js/liferay/available_languages.jsp?browserId=other&themeId=LP5ellucian_WAR_LP5elluciantheme&colorSchemeId=01&minifierType=js&languageId=en_US&b=6120&t=1393433346000

200 OK (text/javascript)



CONNECT http://wiki.shibboleth.net:443

200 Connection established ()



CONNECT http://wiki.shibboleth.net:443

200 Connection established ()


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140226/50e43003/attachment.html