CAS proxy validation failing

[Marvin Addison]

On Mon, Mar 4, 2019 at 7:26 PM Andrew Morgan <morgan at orst.edu> wrote:
> So...  It appears they are protecting the proxy receptor endpoint with CAS
> authentication...  :/

That's definitely a configuration error on their part.

> I think Shibboleth is following the CAS protocol spec by validating the
> certificate name matches the hostname and by following the 302 redirect.

I agree that it's not incorrect according to the protocol, "CAS MAY
follow any HTTP redirects issued by the pgtUrl", but my gut reaction
here is that it's incorrect _default_ behavior. I'm inclined to switch
the default to not follow redirects and to expose configuration
properties that toggle the behavior on in the rare chance it's needed.
Honestly I think that that a 302 response is most commonly a sign of
configuration problems in this case, so not following by default seems
like a helpful diagnostic behavior.

If you agree, could file an issue and assign to me?

As for how to configure Shib to not follow redirects for CAS proxy, I
reviewed the components Scott cited, but I don't see a way to do it
without modifying source, which for most deployments is a tall order.
If you are able to modify source, I can work up a simple patch.

Thanks,
Marvin