encoded CAS ticket validation error

[Andrew Morgan]

I have enabled encoded CAS Service Tickets.  After running this way for a 
few weeks, I finally switched my session storage to the client storage:

   idp.session.StorageService = shibboleth.ClientSessionStorageService

and set my CAS session storage to in-memory:

   idp.cas.StorageService=shibboleth.StorageService


However, I'm getting an error in idp-process.log during ticket validation:

2017-12-07 15:40:16,481 - INFO [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:117] - Successfully validated ST-AAlzZWNyZXQ3MjYS7AOhZS5Wt7tSgEXz2mKxVD-lhBBwxC0BZATydilAz8DbAvwRFsCZJqbDFfyvF6mQ1N9tdIAHPVcmQGDCyLXPu0NVU8r4FZi8_ur4MkfMdXisZ0cAGIwtE_FHQ0d28h56fz65kBYxChXo7YRtnItFlxCyHiSNUU4unk6CmaDCtwR_dHFZ0eOomqLAuZehbzyD2K0MxX6bA4CZTmKX9Oq4sTEluFZTcoI_5TqCYnta2onp8jdFpisTbnPMf9Ka6csK5ixI8CqLkbJxtX64A-Y3xndG42EkTGR1CDr46oHGr89O-rpO4KTlq39cctPgoNxtJ-lElg for xxx
2017-12-07 15:40:16,601 - ERROR [net.shibboleth.idp.session.impl.StorageBackedSessionManager:809] - Exception while querying for session ID 909f36e33ca4dac24e402e8c909fa5a2b2946fab49a659b65d8f2e58db4174b5
java.io.IOException: net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Storage object was not present in session
         at org.opensaml.storage.AbstractMapBackedStorageService.readImpl(AbstractMapBackedStorageService.java:307)
Caused by: net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Storage object was not present in session
         at net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Constraint.java:227)
2017-12-07 15:40:16,608 - WARN [net.shibboleth.idp.cas.flow.impl.UpdateIdPSessionWithSPSessionAction:95] - Possible sign of misconfiguration, IdPSession resolution error: {}
net.shibboleth.utilities.java.support.resolver.ResolverException: Exception while querying for session
         at net.shibboleth.idp.session.impl.StorageBackedSessionManager.lookupBySessionId(StorageBackedSessionManager.java:811)
Caused by: java.io.IOException: net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Storage object was not present in session
         at org.opensaml.storage.AbstractMapBackedStorageService.readImpl(AbstractMapBackedStorageService.java:307)
Caused by: net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Storage object was not present in session
         at net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Constraint.java:227)
2017-12-07 15:40:16,609 - INFO [net.shibboleth.idp.cas.flow.impl.UpdateIdPSessionWithSPSessionAction:111] - Cannot store CASSPSession since IdPSession not found


The validation is successful, though.  It seems like Shibboleth is trying 
to store the CAS SP session in the IDP session, which it cannot do because 
the user's session cookie is not present during ticket validation.

This happens whether I have htmlLocalStorage enabled or disabled.

I tried setting:

   idp.cas.StorageService=shibboleth.ClientSessionStorageService

but that didn't make a difference either.

Is there a workaround for this?  Should the IDP be smart enough to know 
that it can't do this operation when client-side storage is being used 
with encoded CAS tickets?  Maybe there is a way to suppress the errors at 
least...

Thanks,
 	Andy