CAS renew not honored in v3.4.1

[Andrew Morgan]

On Thu, 20 Dec 2018, Cantor, Scott wrote:

> On 12/19/18, 8:26 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>
>> I have idp.authn.favorSSO = false because we needed the MFA flow to run on
>> every auth request.  I'm not sure if that is relevant here.
>
> Not necessary anymore, but it shouldn't matter.

I switched to the v3.4 way of specifying this, but it didn't change the 
CAS renew behavior (as expected).

>> Any other info I can share that will help?  Is there is any logging to
>> turn on?
>
> On debug, I think it should log something somewhere about the state of 
> the authentication context and that should dump out the forceAuthn flag 
> stored in it at the point it's starting the login step.
>
> Apart from that, just seeing at a detailed level what happens during 
> authentication I guess. Where the appearance of SSO is really coming 
> from.
>
> I have to assume something is interfering and preventing the parameter 
> from being visible to the CAS code to get it set, but the code that's 
> checking for it is the exact same bit that pulls out the service 
> parameter, so it's not like it's getting skipped.

I set logging to DEBUG for org.springframework and 
net.shibboleth.idp.authn.  I ended up seeing this (summarized):

DEBUG [org.springframework.webflow.executor.FlowExecutorImpl:135] - Launching new execution of flow 'cas/login' with input map['service' -> 'http://people.oregonstate.edu/~morgan/CAS-1.3.4/test.php', 'renew' -> 'true']
...
DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn at 122d4c8
DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do

Are there other loggers that I can turn up to DEBUG to get at the 
in-between parts of this log summary?

Thanks,
 	Andy