CAS in IdP v3

[Brian Biggs]

This may not be the place to post it, but here's an example of the 
config I'm using in jetty-rewrites.xml:

       <!-- /cas-server/serviceValidate to 
/idp/profile/cas/serviceValidate -->
       <Call name="addRule">
         <Arg>
           <New 
class="org.eclipse.jetty.rewrite.handler.RewritePatternRule">
             <Set name="pattern">/cas-server/serviceValidate</Set>
             <Set name="replacement">/idp/profile/cas/serviceValidate</Set>
           </New>
         </Arg>
       </Call>

It does seem to work, except for inserting the jsessionid stuff between 
the location and the query string.

Should I be doing it differently?

The flow goes like this:

I go to https://ldap-cgi2.dev.sonoma.edu/portal
I'm redirected to https://auth.dev.sonoma.edu/idp/profile/cas/login 
where I enter credentials
I'm then redirected back to 
https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi?ticket=ST-1454534191446-LVoKpweQ4BhH3g4Q8Bphwnl0Y 
(which is our portal and it works fine)
 From there, when I try to go to https://ldap-cgi2.dev.sonoma.edu/portal 
(which should just redraw the page with a new ST), I get redirected to 
this URL:
https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=1jdp54hlph8tt14mvka8xukxm1?ticket=ST-1454534211931-IckWXOAqD6JAsLdmbj5ide6mC

Thanks,
-Brian

On 02/03/2016 11:53 AM, Cantor, Scott wrote:
> On 2/3/16, 2:33 PM, "users on behalf of Brian Biggs" <users-bounces at shibboleth.net on behalf of brian.biggs at sonoma.edu> wrote:
>
>
>
>> I was able to change the path in the shib cookie, and that did solve
>> part of the problem. But I've also got a JSESSIONID cookie with a path
>> of /idp that I can't really mess with, and that seems to be causing
>> jetty to insert ";jsessionid=blah" into the URL in between the location
>> and the query string.
>>
>> So "https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi?ST=blah" becomes
>> "https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=blah?ST=blah"
>> in the redirect after ticket validation. I have no idea if that is being
>> caused by the rewrite or it's just jetty doing it's thing.
> I think you have a mistake somwehere, there's no reason the container would know to modify the URL of something not even referencing the container. The URLs to the container might have it inserted if the session cookie isn't set, but not a URL sitting in a parameter.
>
> -- Scott
>

-- 

Brian Biggs
Sonoma State University