CAS error: E_ILLEGAL_STATE

[Dimitris Maniadakis]

Hello,
we have enabled CAS protocol in our Shibboleth 3.3.0 according to instructions in https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration
We tried to test it with the use of phpCAS 1.3.5.
The ticket is granted from the idp and sent to the CAS client.
However, we face a problem with the response of the idp, which is  "E_ILLEGAL_STATE" and the ticket is not validated!

In particular, after filling in credentials, I get in the browser:

Authentication failure: Ticket not validated
Reason: [INTERNAL_ERROR] CAS error: E_ILLEGAL_STATE

It is obviously an error in the server side (idp). What should I check, which log? What is E_ILLEGAL_STATE?
The log in idp-process.log:

DEBUG [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:107] - Granting service ticket for http://XXXXX/example_html.php
EBUG [net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:187] - Storing ST-1507722202059-TDSDZcvH3VWRV8RNzXKAcC4c7 in context https://www.apereo.org/cas/protocol/login
INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] - Granted service ticket for http://XXXXX/example_html.php
INFO [Shibboleth-Audit.SSO:241] - 20171011T114322Z|||http://XXXXX/example_html.php|https://www.apereo.org/cas/protocol/login||||userYYY|||userYYY|ST-1507722202059-TDSDZcvH3VWRV8RNzXKAcC4c7| 

And stops at this point.

The log in the CAS client (phpCAS.log) includes the response of the idp:

Authentication failure: Ticket not validated [AuthenticationException.php:81]
Reason: [INTERNAL_ERROR] CAS error: E_ILLEGAL_STATE [AuthenticationException.php:97]
CAS response: <?xml version="1.0" encoding="UTF-8"?>
<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
  <cas:authenticationFailure code="INTERNAL_ERROR">
    E_ILLEGAL_STATE
  </cas:authenticationFailure>
</cas:serviceResponse>
 [AuthenticationException.php:102]
exit()


P.S. Ticket is neither validated with the use of another CAS client (Apereo Java CAS Client). It stops at the validation step as well...

Thanks you,

Dimitris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171102/9c73a4d8/attachment.html>