<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Does anyone have an idea which class constructs the CAS redirect URL ?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I have been walking through code today and it is not terribly apparent exactly where this is happening.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Mackay, Rob<br>
<b>Sent:</b> Wednesday, February 26, 2014 3:13 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Handler dropping port from service url passed by CAS Auth Filter<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">When running the IDP on non-standard SSL ports (444) and CAS on non-standard ports (8447) the login handler appears to be using a server url without a port defined when forwarding to the CAS webapp.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Where is the service value for the CAS redirect defined, is it constructed from a non-property based location or is part of the configuration somewhere ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">As you can see from the following fiddler logs the SP has successfully redirected to the 444 port where the IDP is running, several redirects later it is still operating on the 444 port until it hits the CAS redirect at the third entry
below. The service url passed to CAS does not contain the 444 SSL port for shib and is failing on login at this point.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If the system is configured with the SSL port for Shib using the default 443 it works without issue.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If the entry below is modified like the following line it works as expected<br>
<span style="background:yellow;mso-highlight:yellow">GET <a href="https://testlp5.ellucian.com:444/idp/Authn/RemoteUser">
https://testlp5.ellucian.com:444/idp/Authn/RemoteUser</a><o:p></o:p></span></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">302 Redirect to
<a href="https://testlp5.ellucian.com:8447/cas-web/login?service=https%3A%2F%2Ftestlp5.ellucian.com%3A444%2Fidp%2FAuthn%2FRemoteUser">
https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%3A444%2Fidp%2FAuthn%2FRemoteUser</a></span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I have been unable to find a way to instruct the handler to use the port when constructing this url.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Fiddler log -------<o:p></o:p></p>
<p class="MsoPlainText">POST <a href="https://testlp5.ellucian.com:444/idp/profile/SAML2/POST/SSO">
https://testlp5.ellucian.com:444/idp/profile/SAML2/POST/SSO</a><o:p></o:p></p>
<p class="MsoPlainText">302 Redirect to <a href="https://testlp5.ellucian.com:444/idp/AuthnEngine">
https://testlp5.ellucian.com:444/idp/AuthnEngine</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET <a href="https://testlp5.ellucian.com:444/idp/AuthnEngine">
https://testlp5.ellucian.com:444/idp/AuthnEngine</a><o:p></o:p></p>
<p class="MsoPlainText">302 Redirect to <a href="https://testlp5.ellucian.com:444/idp/Authn/RemoteUser">
https://testlp5.ellucian.com:444/idp/Authn/RemoteUser</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">GET <a href="https://testlp5.ellucian.com:444/idp/Authn/RemoteUser">
https://testlp5.ellucian.com:444/idp/Authn/RemoteUser</a><o:p></o:p></span></p>
<p class="MsoPlainText"><span style="background:yellow;mso-highlight:yellow">302 Redirect to
<a href="https://testlp5.ellucian.com:8447/cas-web/login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser">
https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser</a></span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://testlp5.ellucian.com:8447">http://testlp5.ellucian.com:8447</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://testlp5.ellucian.com:8447">http://testlp5.ellucian.com:8447</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET <a href="https://testlp5.ellucian.com:8447/cas-web/login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser">
https://testlp5.ellucian.com:8447/cas-web//login?service=https%3A%2F%2Ftestlp5.ellucian.com%2Fidp%2FAuthn%2FRemoteUser</a><o:p></o:p></p>
<p class="MsoPlainText">302 Redirect to <a href="https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com">
https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://testlp5.ellucian.com:443">http://testlp5.ellucian.com:443</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://testlp5.ellucian.com:443">http://testlp5.ellucian.com:443</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET <a href="https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com">
https://testlp5.ellucian.com/idp/Authn/RemoteUser?ticket=ST-132-mRrKBjtcubIB1yLCdUqn-testlp5.ellucian.com</a><o:p></o:p></p>
<p class="MsoPlainText">404 Not Found (text/html)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://testlp5.ellucian.com:443">http://testlp5.ellucian.com:443</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://testlp5.ellucian.com:443">http://testlp5.ellucian.com:443</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection Established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GET <a href="https://testlp5.ellucian.com/html/js/liferay/available_languages.jsp?browserId=other&themeId=LP5ellucian_WAR_LP5elluciantheme&colorSchemeId=01&minifierType=js&languageId=en_US&b=6120&t=1393433346000">
https://testlp5.ellucian.com/html/js/liferay/available_languages.jsp?browserId=other&themeId=LP5ellucian_WAR_LP5elluciantheme&colorSchemeId=01&minifierType=js&languageId=en_US&b=6120&t=1393433346000</a><o:p></o:p></p>
<p class="MsoPlainText">200 OK (text/javascript)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://wiki.shibboleth.net:443">http://wiki.shibboleth.net:443</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CONNECT <a href="http://wiki.shibboleth.net:443">http://wiki.shibboleth.net:443</a><o:p></o:p></p>
<p class="MsoPlainText">200 Connection established ()<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>