CAS proxy validation failing

[Marvin Addison]

On Fri, Mar 1, 2019 at 6:27 PM Andrew Morgan <morgan at orst.edu> wrote:
> It appears that v3.4.1 didn't try to validate the names...

That is correct. 3.4.3 moved to conform HttpClient machinery on the
work Brent did in that area for dynamic metadata loading (I believe)
and the dev team agreed that using the same machinery was the correct
approach.

> However, I also notice that it seems to be trying to validate the
> certificate for login.oregonstate.edu (the IDP hostname) in both versions.

That is the root cause of the problem. That hostname is not in the set
of allowed names:

2019-03-01 15:00:21,319 - DEBUG
[org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:255]
- Trusted names being evaluated are:
[https://myosu.oregonstate.edu:443/c/portal/login,
lum-admin.ucsadm.oregonstate.edu]

> Why is that being checked?

I'd need more logs to say for certain. Let's start by turning up
net.shibboleth.idp.cas to DEBUG and reproducing the error. That will
give many more details about the CAS proxy machinery.

Thanks,
Marvin