IDP + CAS integration - Incorrect entity ID in conversion state

[Pinate Aramsangrungroj]

Hi,

We have IDP v4.3.1 + CAS integration. It has been all working fine for years.

However, we recently discovered something which is unusual. It is about wrong Entity ID being passed in conversation state. Here is what happened


  1.
Users try to access Service Provider/application  A

  2.
The request is redirected to IDP with AuthnRequest having issuer with EntityID=applicationA
2.1 POST https://<<IDPSERVER>>/idp/profile/SAML2/POST/SSO<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO>

  3.
IDP then redirects the request to CAS for authentication with following flows

3.1 GET https://<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO?execution=e1s1><<IDPSERVER>><https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO>/idp/profile/SAML2/POST/SSO?execution=e1s1<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO?execution=e1s1>
3.2 POST https://<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO?execution=e1s1><<IDPSERVER>><https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO>/idp/profile/SAML2/POST/SSO?execution=e1s1<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO?execution=e1s1>
3.3 GET https://<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO?execution=e1s2><<IDPSERVER>><https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO>/idp/profile/SAML2/POST/SSO?execution=e1s2<https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO?execution=e1s2>, then redirect to next request
3.4 GET https://<https://idpweb1.vu.edu.au/idp/Authn/External?conversation=e1s2><<IDPSERVER>><https://idpweb1.vu.edu.au/idp/profile/SAML2/POST/SSO>/idp/Authn/External?conversation=e1s2<https://idpweb1.vu.edu.au/idp/Authn/External?conversation=e1s2> , then redirect to next request
3.5 GET https://<<CASSERVER>>/cas/login?service=https://<<IDPSERVER>>/idp/Authn/External?/conversation=e1s2&entityId=<https://login.vu.edu.au/cas/login?service=https%3A%2F%2Fidpweb1.vu.edu.au%2Fidp%2FAuthn%2FExternal%3Fconversation%3De1s2&entityId=https%3A%2F%2Fmyvu.edu.au%2Fmyvu>applicationB/C/D

At step 3.5 we found the entity ID passed to CAS from IDP ( step 3.4) appears to be from random other SPs configured on IDP server e.g. applicationA, application B, applicationC etc.  We expect the entityID=applicationA, but most of the time it doesn't. As a result of incorrect entity ID passed to CAS, the CAS login doesn't work as expected.

We have tried in private window/incognito mode and clear browser histories, but it doesn't help.

Could anyone please advise what could cause the issue and how to resolve it?

Thanks,
Pinate



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260819/8110af0d/attachment.htm>