CAS Service URL issue?

[Dan Oachs]

We received the following question from our web guys and was wondering 
if anyone could help us out?


We are using IDP 3.3.1 running on linux with jetty 9.3.7


> When using cas protocol version 2 in IDP3, it changes the service url
> when it redirects back after authentication. When specifying a service
> that contains pluses, it redirects with the pluses converted to an
> encoded space. That makes sense since pluses are the valid way to
> represent a space in a query string, and %20 is the valid way to
> represent a space in the path. However, it appears to store that space
> as a space for the service URL in IDP3(per the logs), and when you
> perform a service validation after it redirects back, it sees that a
> space character isn't the same as %20 (since it redirects back with
> %20). A similar issue arises when you have two forward slashes in the
> path. It stores the service URL with the double slashes, but redirects
> back to the client with a single slash so you get a service mismatch
> error. Is there a configuration setting that needs to be adjusted? Or
> is this a bug?
>
>
> Space example
>
> Initial request:
> 	https://sso.gac.edu/idp/profile/cas/login?service=https%3A%2F%2Fbeta.gac.edu%2Fcalendar%2Fsearch%2Fall+employee+meeting
> 	Cookie: JSESSIONID=1m1tammwzzyuw113ttc0kkw8g1
> Redirects back to:
> 	https://beta.gac.edu/calendar/search/all%20employee%20meeting?ticket=ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b
>
> Log file has:
> idp-process.log:2017-05-16 09:51:59,197 - INFO
> [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] -
> Granted service ticket forhttps://beta.gac.edu/calendar/search/all  
> employee meeting 2620:46:8000:64:e23f:49ff:feac:5047
> idp-process.log:2017-05-16 09:51:59,198 - INFO
> [Shibboleth-Audit.SSO:241] -
> 20170516T145159Z|||https://beta.gac.edu/calendar/search/all  employee
> meeting|https://www.apereo.org/cas/protocol/login||||testuser|||testuser|ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b|  
> 2620:46:8000:64:e23f:49ff:feac:5047
> idp-process.log:2017-05-16 09:51:59,231 - WARN
> [net.shibboleth.idp.cas.service.impl.DefaultServiceComparator:86] -
> Error parsinghttps://beta.gac.edu/calendar/search/all  employee meeting
> 2620:46:8000:128::16
> idp-process.log:2017-05-16 09:51:59,231 - INFO
> [Shibboleth-Audit.SSO:241] -
> 20170516T145159Z|||https://beta.gac.edu/calendar/search/all%20employee%20meeting|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b|  
> 2620:46:8000:128::16
>
>
> Double slash example
>
> Initial request:
> 	https://sso.gac.edu/idp/profile/cas/login?service=https%3A%2F%2Fbeta.gac.edu%2F%2Fregistrar%2Ffinals.php
>
> Redirects back to:
> 	https://beta.gac.edu/registrar/finals.php?ticket=ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI
>
> Log file has:
> idp-audit.log:20170516T151412Z|||https://beta.gac.edu//registrar/finals.php|https://www.apereo.org/cas/protocol/login||||testuser|||testuser|ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI||2620:46:8000:64:e23f:49ff:feac:5047|
> idp-audit.log:20170516T151412Z|||https://beta.gac.edu/registrar/finals.php|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI||2620:46:8000:128::16|
> idp-process.log:2017-05-16 10:14:12,755 - INFO
> [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] -
> Granted service ticket forhttps://beta.gac.edu//registrar/finals.php  
> 2620:46:8000:64:e23f:49ff:feac:5047
> idp-process.log:2017-05-16 10:14:12,756 - INFO
> [Shibboleth-Audit.SSO:241] -
> 20170516T151412Z|||https://beta.gac.edu//registrar/finals.php|https://www.apereo.org/cas/protocol/login||||testuser|||testuser|ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI|  
> 2620:46:8000:64:e23f:49ff:feac:5047
> idp-process.log:2017-05-16 10:14:12,796 - INFO
> [Shibboleth-Audit.SSO:241] -
> 20170516T151412Z|||https://beta.gac.edu/registrar/finals.php|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI|  
> 2620:46:8000:128::16


Thanks,

     Dan Oachs

     Gustavus Adolphus College


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170605/3f36ab39/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3984 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170605/3f36ab39/attachment.p7s>