CAS proxy validation failing

[Andrew Morgan]

On Tue, 5 Mar 2019, Cantor, Scott wrote:

> On 3/4/19, 7:26 PM, "users on behalf of Andrew Morgan" 
> <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>
>> If this is all true, is there any setting in Shibboleth that would stop 
>> it from following the redirects?  Any other Shibboleth suggestions?
>
> I don't know if just not following them is going to help you, but if you 
> have control over the specific HttpClient instance it's using in the CAS 
> validate action (is that documented in the config?), there is a setting 
> on the builder class we built that lets you disable following them.
>
> The docs I wrote in the wiki on HttpClientConfiguration are based on 
> using a built-in bean that has fewer options on it. The underlying class 
> called 
> "net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder" has 
> more properties, one of which is httpFollowRedirects.

I found these beans in system/conf/cas-protocol-system.xml:

     <bean id="proxyHttpClient" parent="shibboleth.NonCachingHttpClient"
           p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory" />

     <bean id="proxyHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
           ...
     </bean>

     <bean id="proxyValidator"
           class="net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator"
           c:client-ref="proxyHttpClient"
           c:parameters-ref="proxyHttpSecurity" />

If I wanted to override the proxyHttpClient bean by creating a 
HttpClientBuilder bean, how would I do that?  Do I just create a bean with 
the same id in conf/cas-protocol.xml?  I don't see any uses of 
HttpClientBuilder in the configuration files of Shibboleth, so I'm not 
sure what xml to use to end up with an equivalent NonCachingHttpClient 
with httpFollowRedirects=false.

Probably, we need to go tell the Luminis folks to fix this, but I'm kinda 
curious about some of the principles of beans still.

Thanks,
 	Andy