CAS in IdP v3

[Marvin Addison]

>
> 13:29:42.783 - DEBUG
> [org.eclipse.jetty.rewrite.handler.RuleContainer:167] - rew
> rote /cas-server/login to /idp/profile/cas/login
>
> 13:29:43.097 - DEBUG [org.eclipse.jetty.server.Server:520] - RESPONSE
> for /cas-s
> erver/login h=true
> 302 null
> Set-Cookie: JSESSIONID=qq7wly12bjqbw1rg6ogoltdn;Path=/idp;Secure
> Expires: Thu, 01 Jan 1970 00:00:00 GMT
> Cache-Control: no-store
> Location:
> https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=qq7wly12b
> jqbw1rg6ogoltdn?ticket=ST-1454534983074-PNvIpJ7iyd0KrHFy9drsCnoZV
> <https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=qq7wly12bjqbw1rg6ogoltdn?ticket=ST-1454534983074-PNvIpJ7iyd0KrHFy9drsCnoZV>


I believe I see what's going on here. First, note that the session ID in
the path parameter is the same as that in the Set-Cookie header. Second,
this is just "how servlets work," which is something I discovered recently
tracking down a similar issue when browser session cookies were turned off.
You're effectively getting in the same situation due to cookie path
mismatch caused by your rewrite rule. Here's a brief explanation of servlet
session mechanics, which I hope will help clarify.

When a session is started, the servlet container _by default_ sets a path
parameter of ;jsessionid=[session ID] at the servlet context path in
addition to the Set-Cookie header. If a subsequent request to the IdP
contains _both_ the path parameter and the cookie header, the servlet
container culls the path parameter since it knows the client has received
the cookie. Typically the jsessionid is stripped off naturally during the
login process:

GET
https://login.vt.edu/profile/cas/login?service=https://www.middleware.vt.edu/
302
Location:
https://login.vt.edu/profile/cas/login;jsessionid=1mlugzaw2fs9v1enrs7267jnhm?execution=e1s1
Set-Cookie:JSESSIONID=1mlugzaw2fs9v1enrs7267jnhm;Path=/;Secure

GET
https://login.vt.edu/profile/cas/login;jsessionid=1mlugzaw2fs9v1enrs7267jnhm?execution=e1s1
Cookie:JSESSIONID=1mlugzaw2fs9v1enrs7267jnhm
200

POST https://login.vt.edu/profile/cas/login?execution=e1s1
302
Location:https://login.vt.edu/profile/cas/login?execution=e1s2
<https://login-dev.middleware.vt.edu/profile/cas/login?execution=e1s2>

You can see that the path parameter is gone by the time credentials are
posted to the login form. In your case that's not happening presumably
because of the mismatch between the session ID cookie path and the location
on your IdP.

The path parameter is appended to every outgoing redirect by the servlet
container and happens at such a low level that it's hard to determine when
it should be stripped. Here's an issue that I filed when I was fighting
this at my home institution:

https://jira.spring.io/browse/SPR-13693?filter=-2

You can try getting the cookie path fixed or toggle the Jetty flag I
mentioned in the issue above; either should fix you up.

M <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/8330b3da/attachment-0001.html>