Handler dropping port from service url passed by CAS Auth Filter

[Kevin Foote]

Guessing.
Are you fronting this config with HTTPD? If so ensure that your ServerName values are fully defined port and all.

--------
thanks
 kevin.foote

On Feb 26, 2014, at 2:13 PM, Mackay, Rob <Rob.Mackay at ellucian.com> wrote:

> When running the IDP on non-standard SSL ports (444) and CAS on non-standard ports (8447) the login handler appears to be using a server url without a port defined when forwarding to the CAS webapp.
>  
> Where is the service value for the CAS redirect defined, is it constructed from a non-property based location or is part of the configuration somewhere ?
>  
> As you can see from the following fiddler logs the SP has successfully redirected to the 444 port where the IDP is running, several redirects later it is still operating on the 444 port until it hits the CAS redirect at the third entry below. The service url passed to CAS does not contain the 444 SSL port for shib and is failing on login at this point.
>  
> If the system is configured with the SSL port for Shib using the default 443 it works without issue.
>  
> If the entry below is modified like the following line it works as expected
> GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser
> 302 Redirect to https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%3A444%2Fidp%2FAuthn%2FRemoteUser
>  
> I have been unable to find a way to instruct the handler to use the port when constructing this url.
>  
> Fiddler log -------
> POST https://testlp5.ellucian.com:444/idp/profile/SAML2/POST/SSO
> 302 Redirect to https://testlp5.ellucian.com:444/idp/AuthnEngine
>  
> GET https://testlp5.ellucian.com:444/idp/AuthnEngine
> 302 Redirect to https://testlp5.ellucian.com:444/idp/Authn/RemoteUser
>  
> GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser
> 302 Redirect to https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser
>  
> CONNECT http://testlp5.ellucian.com:8447
> 200 Connection Established ()
>  
> CONNECT http://testlp5.ellucian.com:8447
> 200 Connection Established ()
>  
> GET https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser
> 302 Redirect to https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> GET https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com
> 404 Not Found (text/html)
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> GET https://testlp5.ellucian.com/html/js/liferay/available_languages.jsp?browserId=other&themeId=LP5ellucian_WAR_LP5elluciantheme&colorSchemeId=01&minifierType=js&languageId=en_US&b=6120&t=1393433346000
> 200 OK (text/javascript)
>  
> CONNECT http://wiki.shibboleth.net:443
> 200 Connection established ()
>  
> CONNECT http://wiki.shibboleth.net:443
> 200 Connection established ()
>  
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net