CAS clients using Saml11TicketValidator problem

[O'Dowd, Josh]

Hello again,

In our quest to move our campus to a single SSO, Shibboleth IDP3, we are faced with a number of proprietary grails-based applications which are using the spring security CAS grails plugin and the vendor module appears to depend on SAML1.1 configuration and not CAS protocol, thus the use of the Saml11TicketValidator.

The problem appears to be that IDP3 is responding with a SAML-SOAP 1.1 response, the beginning of which looks like:
<?xml version="1.0" encoding="UTF-8"?><soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/"><soap11:Body><saml1p:Response ...

The parse function in the Saml11TicketValidator, which is failing is trying to strip off the body tags with the following lines:
                final String removeStartOfSoapBody = response.substring(response.indexOf("<SOAP-ENV:Body>") + 15);
                final String removeEndOfSoapBody = removeStartOfSoapBody.substring(0, removeStartOfSoapBody.indexOf("</SOAP-ENV:Body>"));

The result is a String index error in the second line, but the cause is obviously the difference between the response tags, which are <soap11:Body> and the validator is looking for <SOAP-ENV:Body>.

I am hopeful this is a simple matter of configuration options on the IDP because we are restricted on the vendor app.  If the vendor was truly more open-ended with the configuration, I would already have gladly implemented the spring security shibboleth native-SP grails plugin (gee, why didn't they think about that?).

As always, thanks for your time and any help you can give.

Josh O'Dowd
Software Systems Analyst / Developer
University of Montana, IT Central
(406)243-6283

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150901/2cf292fd/attachment.html>