CAS tickets length/format

[Mircea Baciu]

​Just in case anybody runs into the same issue I have. The cas-protocol.xml
clearly states that since 3.3.0 the ticket service "serializes ticket data
into the opaque section of the ticket ID for service tickets and proxy
tickets."

This behavior can be reverted back by enabling <alias
name="simpleTicketService" alias="shibboleth.CASTicketService" /> instead
of <alias name="encodingTicketService" alias="shibboleth.CASTicketService"
/>

My original problem with the Ruby on Rails application was tracked down to
the fact that the CAS service validate response includes the <?xml
version="1.0" encoding="UTF-8"?> line (system/views/cas/header.vm).
Customizing this file (actually a copy in views/cas) to drop that line
fixed the problem. I assume that newer Ruby on Rails code and/or associated
gems would not have this issue.

Mircea

--
Mircea Baciu, Sr. Unix Systems Administrator
Simmons College, Boston, MA

On Thu, Apr 20, 2017 at 5:05 PM, Mircea Baciu <mircea.baciu at simmons.edu>
wrote:

> Hi,
>
> We have an IdP version 3.3.1 working, with CAS enabled. I managed to
> migrate most of the SPs off a JA-SIG CAS server to Shibboleth IdP with no
> issues, except for one old Ruby on Rails application. After a successful
> IdP login, the browser gets back to the SP and displays an 500 error.
>
> Digging into this I found out that the IdP is passing a ticket that is way
> longer and its format is different than what the CAS server is generating.
>
> Here's a ticket from IdP:
> ST-AAhzZWNyZXQyMLjnIZ_lGXRqhpMw2sKmON-CHB_KixeV_Mr35-aB46_
> zutFyEXiVESYYRgTX7JexOSd2MjxVFoe0fIwcTqf6bTQUjlHiJudA_
> GRbzXGtpXJzQEtJMtVVlKfPr7QSLP-ppxmE8RbMvB9SQuKmXb0bXinRTrpO4GM_
> jZkQBAOxARnHSEzN2ATd5qVgkfSHTGCTNs-fJJ-hzw1zJnURH8IDskoqN0xQkeOE--
> CDOPB5UpoMgeIIRKP9lZaJApg-mgANUzI4UnrFgpoUMpQRfpIHKt2wJX_dILBBtZqSs5VW7Hlw
>
> The CAS server ticket looks like this: ST-14868-
> 0AvPvOss9kIUvFmCBhDi-login.simmons.edu
>
> My feeling is that the application's CAS client is not happy to see such a
> long ticket and that causes the error.
>
> Is there way to control the length and/or format of the ST tickets
> generated by the IdP?
>
> Thanks,
> Mircea
>
> --
> Mircea Baciu, Sr. Unix Systems Administrator
> Simmons College, Boston, MA
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170425/439edec7/attachment.html>