<div dir="ltr">
<div>A CAS service is triggering an error on initial login (oddly, a second attempted login usually works). First serious attempt to include a CAS service, so struggling to comprehend this sequence. Pointers appreciated.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:748 DEBUG [10.5.0.58] net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:89 > <b>Granting service ticket</b> for <a href="https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068">https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068</a><br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:749 DEBUG [10.5.0.58] net.shibboleth.idp.cas.ticket.impl.SimpleTicketService:193 > Storing ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr in context <a href="https://www.apereo.org/cas/protocol/login">https://www.apereo.org/cas/protocol/login</a><br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:749 INFO [10.5.0.58] net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:100 > <b>Granted service ticket</b> for <a href="https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068">https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068</a><br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:751 INFO [10.5.0.58] Shibboleth-Audit.SSO:241 > 20170411T175748Z||b7d0bb4f97d7234a13c97bdaa26db904f334d119480fdef08ba107c47471157d|<a href="https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068|https://www.apereo.org/cas/protocol/login||||lttoth|||lttoth|ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr|">https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068|https://www.apereo.org/cas/protocol/login||||lttoth|||lttoth|ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr|</a><br></span></blockquote><div><br></div><div>immediately after, the IdP receives this request: </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:858 DEBUG [137.229.13.137] org.opensaml.saml.saml1.binding.decoding.impl.HTTPSOAP11Decoder:59 > Decoded SOAP messaged which included SAML message of type {urn:oasis:names:tc:SAML:1.0:protocol}Request<br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:861 DEBUG [137.229.13.137] PROTOCOL_MESSAGE:121 ><br></span><span class="gmail-s1"><?xml version="1.0" encoding="UTF-8"?><br></span><span class="gmail-s1"><SOAP-ENV:Envelope xmlns:SOAP-ENV="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"><br></span><span class="gmail-s1"> <SOAP-ENV:Header/><br></span><span class="gmail-s1"> <SOAP-ENV:Body><br></span><span class="gmail-s1"> <samlp:Request IssueInstant="2002-06-19T17:03:44.022Z"<br></span><span class="gmail-s1"> MajorVersion="1" MinorVersion="1"<br></span><span class="gmail-s1"> RequestID="_192.168.16.51.1024506224022" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"><br></span><span class="gmail-s1"> <samlp:AssertionArtifact>ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr</samlp:AssertionArtifact><br></span><span class="gmail-s1"> </samlp:Request><br></span><span class="gmail-s1"> </SOAP-ENV:Body><br></span><span class="gmail-s1"></SOAP-ENV:Envelope></span><br><span class="gmail-s1"></span></blockquote><div><br>[...IdP determines default relying party is applicable...]</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1"><br></span><span class="gmail-s1">09:57:48:875 DEBUG [137.229.13.137] net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:92 > <b>Attempting to validate</b> ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr<br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:876 DEBUG [137.229.13.137] net.shibboleth.idp.cas.ticket.impl.SimpleTicketService:226 > Reading ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr<br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:877 DEBUG [137.229.13.137] net.shibboleth.idp.cas.ticket.impl.SimpleTicketService:215 > <b>Attempting to delete</b> ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr from context <a href="https://www.apereo.org/cas/protocol/login">https://www.apereo.org/cas/protocol/login</a><br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:877 DEBUG [137.229.13.137] net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:101 > <b>Found and removed</b> ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr/b7d0bb4f97d7234a13c97bdaa26db904f334d119480fdef08ba107c47471157d from ticket store<br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:878 DEBUG [137.229.13.137] net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:113 > <b>Service issued</b> for <a href="https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068">https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html;GLMSSESSIONID=4WBeKYKm5WrhFV87HlxEpnVAIwqx9VcNv0pj3uvKXZu4mjDG3kIp!494185068</a> <b>does not match</b> <a href="https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html">https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html</a><br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:880 INFO [137.229.13.137] Shibboleth-Audit.SSO:241 > 20170411T175748Z|||<a href="https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr|">https://temsprep.alaska.edu:9022/tvlexp/tvlexp-flex/index.html|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr|</a><br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:882 DEBUG [137.229.13.137] net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100 > Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding<br></span><span class="gmail-s1"></span></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">09:57:48:885 DEBUG [137.229.13.137] PROTOCOL_MESSAGE:70 ><br></span><span class="gmail-s1"><?xml version="1.0" encoding="UTF-8"?><br></span><span class="gmail-s1"><SOAP-ENV:Envelope xmlns:SOAP-ENV="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"><br></span><span class="gmail-s1"> <SOAP-ENV:Body><br></span><span class="gmail-s1"> <saml1p:Response IssueInstant="2017-04-11T17:57:48.881Z"<br></span><span class="gmail-s1"> MajorVersion="1" MinorVersion="1"<br></span><span class="gmail-s1"> ResponseID="ST-1491933468748-MDJg4Q0lXaLvbcxp4PQrzruDr" xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><br></span><span class="gmail-s1"> <saml1p:Status><br></span><span class="gmail-s1"> <saml1p:<b>StatusCode Value="INVALID_SERVICE"</b> xmlns="<a href="http://www.ja-sig.org/products/cas/">http://www.ja-sig.org/products/cas/</a>"/><br></span><span class="gmail-s1"> <saml1p:StatusMessage><b>E_SERVICE_MISMATCH</b></saml1p:StatusMessage><br></span><span class="gmail-s1"> </saml1p:Status><br></span><span class="gmail-s1"> </saml1p:Response><br></span><span class="gmail-s1"> </SOAP-ENV:Body><br></span><span class="gmail-s1"></SOAP-ENV:Envelope></span><br><span class="gmail-s1">09:57:48:886 DEBUG [137.229.13.137] net.shibboleth.idp.profile.impl.RecordResponseComplete:89 > Profile Action RecordResponseComplete: Record response complete</span></blockquote><div><br></div><div>David Bantz</div><div>UA OIT IAM </div>
<p class="gmail-p2"><span class="gmail-s1"></span></p>
<p class="gmail-p2"><span class="gmail-s1"></span></p>
</div>