CAS issue, not RTFM'n enough?

[John Morrison]

On ons, 2016-03-02 at 18:05 +0000, Marvin Addison wrote:
On Wed, Mar 2, 2016 at 12:28 PM John Morrison <john.morrison at uadm.uu.se<mailto:john.morrison at uadm.uu.se>> wrote:
Where is this 127.0.1.1 coming from and then trying www.apereo.org<http://www.apereo.org>?

That's simply a profile URI that happens to be an HTTPS URL. No connections are made to anything at apereo.org<http://apereo.org>. I may need to document that because it's a point of confusion that has come up before.
OK, thanks

[net.shibboleth.idp.cas.flow.impl.BuildRelyingPartyContextAction:84] -
Setting up RP context for unverified relying party
https://127.0.1.1/cas/
2016-03-02 18:19:36,050 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293] - Resolving relying party configuration
2016-03-02 18:19:36,050 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:299] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty

That's the problem. You're testing a CAS client on the loopback address, and it's not registered in cas-protocol.xml. Because no matching service is found, it's using the "unverified" relying party configuration which does not have CAS protocol support configured by default.

Yes, sorry, I overlooked  this, it was to do with my miss-configured apache host! :)

Is there a better way to have some sort of registration of a cas client, like we do with metadata rather than a simple regex access control?

Cheers, John



M<mailto:users-unsubscribe at shibboleth.net>


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160303/1e280162/attachment.html>