encoded CAS ticket validation error

[Andrew Morgan]

On Fri, 8 Dec 2017, Cantor, Scott wrote:

> On 12/7/17, 7:00 PM, "users on behalf of Andrew Morgan" 
> <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>
>>  Is there a workaround for this?
>
> I would suggest you check your web.xml file for currency with the latest 
> version. I suspect you just have an old-ish copy that predates bug fixes 
> to get the right Java filter wrapped around the CAS endpoint.
>
> This issue has nothing to do with CAS tickets, I don't think, it's just 
> an issue with the client session feature and how it works and the 
> inability of upgrades to overwrite web.xml with necessary changes.

Hmmm.  I checked in the original tar archive of 3.3.2, and I have the same 
web.xml file as the distribution.  I think I replaced it when I upgraded 
the last time.

Digging into the code at:

   https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java;h=6ab88aaba32cd738a61cb4456f5241d4aa3539f7;hb=HEAD

it seems to be failing at line 93:

   session = sessionResolver.resolveSingle(new CriteriaSet(new SessionIdCriterion(ticket.getSessionId())));

I don't see anything in system/flows/cas/validate-abstract-flow.xml that 
would make UpdateIdPSessionWithSPSession conditional on server-side 
storage (especially since the original CAS code required server-side 
storage).  I don't know a lot about how flows work, though.

I don't think I've missed any details of the CAS configuration.  I'm happy 
to share my config if it is relevant.

Let me know if I should file a bug for this.

Thanks,
 	Andy