CAS proxy validation failing

[Andrew Morgan]

On Tue, 5 Mar 2019, Marvin Addison wrote:

> On Mon, Mar 4, 2019 at 7:26 PM Andrew Morgan <morgan at orst.edu> wrote:
>> So...  It appears they are protecting the proxy receptor endpoint with CAS
>> authentication...  :/
>
> That's definitely a configuration error on their part.
>
>> I think Shibboleth is following the CAS protocol spec by validating the
>> certificate name matches the hostname and by following the 302 redirect.
>
> I agree that it's not incorrect according to the protocol, "CAS MAY
> follow any HTTP redirects issued by the pgtUrl", but my gut reaction
> here is that it's incorrect _default_ behavior. I'm inclined to switch
> the default to not follow redirects and to expose configuration
> properties that toggle the behavior on in the rare chance it's needed.
> Honestly I think that that a 302 response is most commonly a sign of
> configuration problems in this case, so not following by default seems
> like a helpful diagnostic behavior.
>
> If you agree, could file an issue and assign to me?
>
> As for how to configure Shib to not follow redirects for CAS proxy, I
> reviewed the components Scott cited, but I don't see a way to do it
> without modifying source, which for most deployments is a tall order.
> If you are able to modify source, I can work up a simple patch.

I'm not comfortable modifying the source for Shibboleth, and we have 
decided that we will make the CAS client fix their behavior instead of 
modifying Shibboleth.  :)

I created Jira issue IDP-1428 to request a property to control following 
redirects.

Thanks,
         Andy