<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">When running the IDP on non-standard SSL ports (444) and CAS on non-standard ports (8447) the login handler appears to be using a server url without a port defined when forwarding to the CAS webapp.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Where is the service value for the CAS redirect defined, is it constructed from a non-property based location or is part of the configuration somewhere ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">As you can see from the following fiddler logs the SP has successfully redirected to the 444 port where the IDP is running, several redirects later it is still operating on the 444 port until it hits the CAS redirect at the third entry
below. The service url passed to CAS does not contain the 444 SSL port for shib and is failing on login at this point.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If the system is configured with the SSL port for Shib using the default 443 it works without issue.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If the entry below is modified like the following line it works as expected<br>
<span style="background:yellow;mso-highlight:yellow">GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">302 Redirect to https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%3A444%2Fidp%2FAuthn%2FRemoteUser</span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I have been unable to find a way to instruct the handler to use the port when constructing this url.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Fiddler log -------<o:p></o:p></p>
<p class="MsoPlainText">POST https://testlp5.ellucian.com:444/idp/profile/SAML2/POST/SSO<o:p></o:p></p>
<p class="MsoPlainText">302 Redirect to https://testlp5.ellucian.com:444/idp/AuthnEngine<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET https://testlp5.ellucian.com:444/idp/AuthnEngine<o:p></o:p></p>
<p class="MsoPlainText">302 Redirect to https://testlp5.ellucian.com:444/idp/Authn/RemoteUser<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">GET https://testlp5.ellucian.com:444/idp/Authn/RemoteUser<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">302 Redirect to https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser</span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://testlp5.ellucian.com:8447<o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://testlp5.ellucian.com:8447<o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser<o:p></o:p></p>
<p class="MsoPlainText">302 Redirect to https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://testlp5.ellucian.com:443<o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://testlp5.ellucian.com:443<o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com<o:p></o:p></p>
<p class="MsoPlainText">404 Not Found (text/html)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://testlp5.ellucian.com:443<o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://testlp5.ellucian.com:443<o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET https://testlp5.ellucian.com/html/js/liferay/available_languages.jsp?browserId=other&themeId=LP5ellucian_WAR_LP5elluciantheme&colorSchemeId=01&minifierType=js&languageId=en_US&b=6120&t=1393433346000<o:p></o:p></p>
<p class="MsoPlainText">200 OK (text/javascript)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://wiki.shibboleth.net:443<o:p></o:p></p>
<p class="MsoPlainText">200 Connection established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT http://wiki.shibboleth.net:443<o:p></o:p></p>
<p class="MsoPlainText">200 Connection established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>