shib-cas-authn3 Different service URLs between login and validation when entityIdLocation=embed

[Carlos Fernandez]

Setup: IdP 3.3.0, shib-cas-authn 3.2.2, CAS 5.0.5, CAS client 3.4.1

When shibcas.entityIdLocation=embed, the service URL sent with the
validation request differs from the one sent for the login request.

>From the logs:
`org.jasig.cas.client.validation.TicketValidationException: Ticket '
ST-8997-qwrkgYqHLZqAHEvlf2EZ-cas.sju.edu' does not match supplied service.
The original service was '
https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&entityId=https://sju.zoom.us'
and the supplied service was '
https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&entityId=https%3A%2F%2Fsju.zoom.us&entityId=https://sju.zoom.us'.`

The validation service URL appears to have the entityID embedded twice,
which CAS flags as invalid and refuses to validate. This results in our IdP
returning an AuthnFailed to the SP (we don't have any other authn methods
in our IdP).

>From rifling through the code a bit, it seems that the CAS CommonUtils
class returns a service URL with the entityID already embedded when the
browser returns from login with the service ticket, after which ShibCAS
embeds the entityID again.

Has anyone else run into this issue? I think this might not be an issue
with older CAS releases -- I know from experience that CAS 3.5 doesn't care
about the service URL during validation, which we discovered when we
upgraded to CAS 5.0.5 and one of our applications no longer worked.

Best regards,
--
Carlos M. Fernández
Enterprise Systems Manager
*Saint Joseph’s University*
Philadelphia PA 19131
T: +1 610 660 1501
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170731/98c38346/attachment.html>