CAS validation error

[Marvin Addison]

On Wed, Apr 12, 2017 at 8:57 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> I don't think the original app here is Java, I was just using that as an
> example of the sort of thing that might cause problems.
>

I'd be willing to bet it is. Putting a path parameter in URLs is a fairly
creative solution to session tracking absent cookies and is actually part
of the servlet specification. Unfortunately it causes a lot of problems in
applications that aren't designed to support them. Even the IdP has had
problems with these in the past, which is why we actually created some
knobs to ignore them. I had forgotten the details, but I dug them up. This
is probably what you want to do if you have lots of Java applications in
your environment that use the CAS protocol against the IdP.

Add the following profile configuration to relying-party.xml:

    <bean id="CAS.ValidateConfiguration.default"
parent="CAS.ValidateConfiguration"
          p:resolveAttributes="false">
        <property name="serviceComparator">
          <bean
class="net.shibboleth.idp.cas.service.impl.DefaultServiceComparator"
                c:parameterNames="[a-z]+sessionid" />
        </property>
    </bean>

And reference it in the overrides:

    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <util:list>
                <ref bean="Shibboleth.SSO.default" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <ref bean="SAML2.SSO.default" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <ref bean="CAS.LoginConfiguration.default" />
                <ref bean="CAS.ProxyConfiguration" />
                <ref bean="CAS.ValidateConfiguration.default" />
            </util:list>
        </property>
    </bean>

Hope that helps,
Marvin <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170412/9d4dfe36/attachment.html>