<div dir="ltr"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>But in idp-process.log I get this:<br></div><div><br></div><div><div>2015-06-11 14:43:04,759 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:182] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'martinicj' succeeded</div><div>2015-06-11 14:43:04,764 - INFO [net.shibboleth.idp.cas.flow.GrantServiceTicketAction:101] - Granted service ticket for <a href="https://cas.sou.edu/secure/" target="_blank">https://cas.sou.edu/secure/</a></div><div>2015-06-11 14:43:04,922 - INFO [net.shibboleth.idp.cas.flow.ValidateTicketAction:117] - Successfully validated ST-1434058984764-CWnL48dV62jogJ8VXk6F7cVUB for <a href="https://cas.sou.edu/secure/" target="_blank" rel="noreferrer">https://cas.sou.edu/secure/</a></div></div></div></blockquote><div><br></div><div>That simply means that the ticket was found in the backing store. There are other actions that follow ticket lookup, and judging by the detail code E_SESSION_EXPIRED, your IdP session could not be found. Are you using a server-side StorageService implementation for the session store? That's required since the CAS ticket validation step is a back-channel request and the default cookie-based store is not suitable in that situation.</div><div><br></div><div>M</div><div><br></div></div></div>