CAS clients using Saml11TicketValidator problem

[O'Dowd, Josh]

Thanks for the help, Walter.  I agree with your assessment of the code from the older client.

Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Walter Forbes Hoehn (wassa)
Sent: Tuesday, September 01, 2015 3:29 PM
To: Shib Users
Subject: Re: CAS clients using Saml11TicketValidator problem

I ran in to this problem with a couple of applications.  In every case, it was easily solved by updating the “CAS Client for Java” jar to a recent version.

-Walter

P.S.  That code, which I dug into some months ago, really chaps my hide.



> On Sep 1, 2015, at 4:24 PM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu> wrote:
> 
> Hello again,
>  
> In our quest to move our campus to a single SSO, Shibboleth IDP3, we are faced with a number of proprietary grails-based applications which are using the spring security CAS grails plugin and the vendor module appears to depend on SAML1.1 configuration and not CAS protocol, thus the use of the Saml11TicketValidator.
>  
> The problem appears to be that IDP3 is responding with a SAML-SOAP 1.1 response, the beginning of which looks like:
> <?xml version="1.0" encoding="UTF-8"?><soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/"><soap11:Body><saml1p:Response …
>  
> The parse function in the Saml11TicketValidator, which is failing is trying to strip off the body tags with the following lines:
>                 final String removeStartOfSoapBody = response.substring(response.indexOf("<SOAP-ENV:Body>") + 15);
>                 final String removeEndOfSoapBody = removeStartOfSoapBody.substring(0, removeStartOfSoapBody.indexOf("</SOAP-ENV:Body>"));
>  
> The result is a String index error in the second line, but the cause is obviously the difference between the response tags, which are <soap11:Body> and the validator is looking for <SOAP-ENV:Body>.
>  
> I am hopeful this is a simple matter of configuration options on the IDP because we are restricted on the vendor app.  If the vendor was truly more open-ended with the configuration, I would already have gladly implemented the spring security shibboleth native-SP grails plugin (gee, why didn’t they think about that?).
>  
> As always, thanks for your time and any help you can give.
>  
> Josh O’Dowd
> Software Systems Analyst / Developer
> University of Montana, IT Central
> (406)243-6283
>  
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net