CAS in IdP v3

[Brian Biggs]

Hi,

I have managed to set the path in both cookies to "/". This has solved 
the problem.
I will use this for deployment, then probably transition all CAS clients 
to the /idp/profile/cas/ path and remove the modification to the cookies 
and the jetty rewrites.

Thanks very much for your help!

FYI, setting the path in the jsessionid cookie turned out to be fairly 
simple:

1. copy web.xml from /opt/shibboleth-idp/webapps/web.xml to 
/opt/shibboleth-idp/edit-webapp/WEB-INF/web.xml
2. add the following to the copied web.xml:

     <!-- try and force the jsessionid path to "/" -->
     <context-param>
<param-name>org.eclipse.jetty.servlet.SessionPath</param-name>
         <param-value>/</param-value>
     </context-param>

3. /opt/shibboleth-idp/bin/build.sh

-Brian

On 02/04/2016 04:36 AM, Marvin Addison wrote:
>
>     13:29:42.783 - DEBUG
>     [org.eclipse.jetty.rewrite.handler.RuleContainer:167] - rew
>     rote /cas-server/login to /idp/profile/cas/login
>
>     13:29:43.097 - DEBUG [org.eclipse.jetty.server.Server:520] - RESPONSE
>     for /cas-s
>     erver/login h=true
>     302 null
>     Set-Cookie: JSESSIONID=qq7wly12bjqbw1rg6ogoltdn;Path=/idp;Secure
>     Expires: Thu, 01 Jan 1970 00:00:00 GMT
>     Cache-Control: no-store
>     Location:
>     https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=qq7wly12b
>     jqbw1rg6ogoltdn?ticket=ST-1454534983074-PNvIpJ7iyd0KrHFy9drsCnoZV
>     <https://ldap-cgi2.dev.sonoma.edu/portal/index.cgi;jsessionid=qq7wly12bjqbw1rg6ogoltdn?ticket=ST-1454534983074-PNvIpJ7iyd0KrHFy9drsCnoZV>
>
>
> I believe I see what's going on here. First, note that the session ID 
> in the path parameter is the same as that in the Set-Cookie header. 
> Second, this is just "how servlets work," which is something I 
> discovered recently tracking down a similar issue when browser session 
> cookies were turned off. You're effectively getting in the same 
> situation due to cookie path mismatch caused by your rewrite rule. 
> Here's a brief explanation of servlet session mechanics, which I hope 
> will help clarify.
>
> When a session is started, the servlet container _by default_ sets a 
> path parameter of ;jsessionid=[session ID] at the servlet context path 
> in addition to the Set-Cookie header. If a subsequent request to the 
> IdP contains _both_ the path parameter and the cookie header, the 
> servlet container culls the path parameter since it knows the client 
> has received the cookie. Typically the jsessionid is stripped off 
> naturally during the login process:
>
> GET 
> https://login.vt.edu/profile/cas/login?service=https://www.middleware.vt.edu/
> 302
> Location:https://login.vt.edu/profile/cas/login;jsessionid=1mlugzaw2fs9v1enrs7267jnhm?execution=e1s1
> Set-Cookie:JSESSIONID=1mlugzaw2fs9v1enrs7267jnhm;Path=/;Secure
>
> GET 
> https://login.vt.edu/profile/cas/login;jsessionid=1mlugzaw2fs9v1enrs7267jnhm?execution=e1s1
> Cookie:JSESSIONID=1mlugzaw2fs9v1enrs7267jnhm
> 200
>
> POST https://login.vt.edu/profile/cas/login?execution=e1s1
> 302
> Location:https://login.vt.edu/profile/cas/login?execution=e1s2 
> <https://login-dev.middleware.vt.edu/profile/cas/login?execution=e1s2>
>
> You can see that the path parameter is gone by the time credentials 
> are posted to the login form. In your case that's not happening 
> presumably because of the mismatch between the session ID cookie path 
> and the location on your IdP.
>
> The path parameter is appended to every outgoing redirect by the 
> servlet container and happens at such a low level that it's hard to 
> determine when it should be stripped. Here's an issue that I filed 
> when I was fighting this at my home institution:
>
> https://jira.spring.io/browse/SPR-13693?filter=-2
>
> You can try getting the cookie path fixed or toggle the Jetty flag I 
> mentioned in the issue above; either should fix you up.
>
> M
>
>
>

-- 

Brian Biggs
Sonoma State University

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/3d7b3839/attachment.html>