CAS in IdP v3

[Brian Biggs]

Th idp debugging isn't showing anything interesting; it parses out the 
session id, looks it up, bumps the expire time, then grants a new 
service ticket:

2016-02-03 13:55:36,624 - INFO 
[net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:100] -
Granted service ticket for https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi
2016-02-03 13:55:36,627 - INFO [Shibboleth-Audit.SSO:241] - 
20160203T215536Z||41fcf9b6d78f1c6e3018a3a471d2ac473b28b77986d6a9b0aed9b8cef3e28ac2|https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi|https://www.apereo.org/cas/protocol/login||||biggsb|||biggsb|ST-1454536536616-SBBLOG9SuninG7w53KtIPcXJ6|

-Brian

On 02/03/2016 02:00 PM, Cantor, Scott wrote:
> On 2/3/16, 4:44 PM, "users on behalf of Brian Biggs" <users-bounces at shibboleth.net on behalf of brian.biggs at sonoma.edu> wrote:
>
>
>
>> 13:29:42.783 - DEBUG
>> [org.eclipse.jetty.rewrite.handler.RuleContainer:166] - app
>> lied
>> org.eclipse.jetty.rewrite.handler.RewritePatternRule[ht][/cas-server/login]
>> [/idp/profile/cas/login]
> Rewriting it to go to the actual IdP URL.
>
>> Location:
>> https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=qq7wly12b
>> jqbw1rg6ogoltdn?ticket=ST-1454534983074-PNvIpJ7iyd0KrHFy9drsCnoZV
> And that, I guess, is the result of the IdP's CAS flow doing work. And suddenly there's a parameter stuck in there. Seems like that has to be a bug in the IdP...we'll have to see what Marvin thinks.
>
> Don't quite see though how this could be something triggered by a rewrite, but I'm thinking maybe the issue has to do with that interfering with the normal JSESSIONID sequence due to the cookie issue, and causing it to appear back in the URL somehow that isn't typical. And then the bug is causing it to get copied inadvertently into the redirect back.
>
> -- Scott
>

-- 

Brian Biggs
Sonoma State University