Handler dropping port from service url passed by CAS Auth Filter

[Mackay, Rob]

Kevin
	Shib IDP 2.4.0 running on tomcat 6 and java 7, I have searched every config file for references that are not complete and have found none that I missed. 

Rob

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin Foote
Sent: Wednesday, February 26, 2014 5:22 PM
To: Shib Users
Subject: Re: Handler dropping port from service url passed by CAS Auth Filter

Guessing.
Are you fronting this config with HTTPD? If so ensure that your ServerName values are fully defined port and all.

--------
thanks
 kevin.foote

On Feb 26, 2014, at 2:13 PM, Mackay, Rob <Rob.Mackay at ellucian.com> wrote:

> When running the IDP on non-standard SSL ports (444) and CAS on non-standard ports (8447) the login handler appears to be using a server url without a port defined when forwarding to the CAS webapp.
>  
> Where is the service value for the CAS redirect defined, is it constructed from a non-property based location or is part of the configuration somewhere ?
>  
> As you can see from the following fiddler logs the SP has successfully redirected to the 444 port where the IDP is running, several redirects later it is still operating on the 444 port until it hits the CAS redirect at the third entry below. The service url passed to CAS does not contain the 444 SSL port for shib and is failing on login at this point.
>  
> If the system is configured with the SSL port for Shib using the default 443 it works without issue.
>  
> If the entry below is modified like the following line it works as 
> expected GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser
> 302 Redirect to 
> https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2
> Ftestlp5.ellucian.com%3A444%2Fidp%2FAuthn%2FRemoteUser
>  
> I have been unable to find a way to instruct the handler to use the port when constructing this url.
>  
> Fiddler log -------
> POST https://testlp5.ellucian.com:444/idp/profile/SAML2/POST/SSO
> 302 Redirect to https://testlp5.ellucian.com:444/idp/AuthnEngine
>  
> GET https://testlp5.ellucian.com:444/idp/AuthnEngine
> 302 Redirect to https://testlp5.ellucian.com:444/idp/Authn/RemoteUser
>  
> GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser
> 302 Redirect to 
> https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2
> Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser
>  
> CONNECT http://testlp5.ellucian.com:8447
> 200 Connection Established ()
>  
> CONNECT http://testlp5.ellucian.com:8447
> 200 Connection Established ()
>  
> GET 
> https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2
> Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser
> 302 Redirect to 
> https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBj
> tcubIB1yLCdUqn-testlp5.ellucian.com
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> GET 
> https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBj
> tcubIB1yLCdUqn-testlp5.ellucian.com
> 404 Not Found (text/html)
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> CONNECT http://testlp5.ellucian.com:443
> 200 Connection Established ()
>  
> GET 
> https://testlp5.ellucian.com/html/js/liferay/available_languages.jsp?b
> rowserId=other&themeId=LP5ellucian_WAR_LP5elluciantheme&colorSchemeId=
> 01&minifierType=js&languageId=en_US&b=6120&t=1393433346000
> 200 OK (text/javascript)
>  
> CONNECT http://wiki.shibboleth.net:443
> 200 Connection established ()
>  
> CONNECT http://wiki.shibboleth.net:443
> 200 Connection established ()
>  
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net