<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>We received the following question from our web guys and was
wondering if anyone could help us out?</p>
<p><br>
</p>
<p>We are using IDP 3.3.1 running on linux with jetty 9.3.7<br>
</p>
<p><br>
</p>
<p>
</p>
<p>
<blockquote type="cite">
<pre wrap="">
When using cas protocol version 2 in IDP3, it changes the service url
when it redirects back after authentication. When specifying a service
that contains pluses, it redirects with the pluses converted to an
encoded space. That makes sense since pluses are the valid way to
represent a space in a query string, and %20 is the valid way to
represent a space in the path. However, it appears to store that space
as a space for the service URL in IDP3(per the logs), and when you
perform a service validation after it redirects back, it sees that a
space character isn't the same as %20 (since it redirects back with
%20). A similar issue arises when you have two forward slashes in the
path. It stores the service URL with the double slashes, but redirects
back to the client with a single slash so you get a service mismatch
error. Is there a configuration setting that needs to be adjusted? Or
is this a bug?
Space example
Initial request:
<a class="moz-txt-link-freetext" href="https://sso.gac.edu/idp/profile/cas/login?service=https%3A%2F%2Fbeta.gac.edu%2Fcalendar%2Fsearch%2Fall+employee+meeting">https://sso.gac.edu/idp/profile/cas/login?service=https%3A%2F%2Fbeta.gac.edu%2Fcalendar%2Fsearch%2Fall+employee+meeting</a>
Cookie: JSESSIONID=1m1tammwzzyuw113ttc0kkw8g1
Redirects back to:
<a class="moz-txt-link-freetext" href="https://beta.gac.edu/calendar/search/all%20employee%20meeting?ticket=ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b">https://beta.gac.edu/calendar/search/all%20employee%20meeting?ticket=ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b</a>
Log file has:
idp-process.log:2017-05-16 09:51:59,197 - INFO
[net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] -
Granted service ticket for <a class="moz-txt-link-freetext" href="https://beta.gac.edu/calendar/search/all">https://beta.gac.edu/calendar/search/all</a>
employee meeting 2620:46:8000:64:e23f:49ff:feac:5047
idp-process.log:2017-05-16 09:51:59,198 - INFO
[Shibboleth-Audit.SSO:241] -
20170516T145159Z|||<a class="moz-txt-link-freetext" href="https://beta.gac.edu/calendar/search/all">https://beta.gac.edu/calendar/search/all</a> employee
meeting|<a class="moz-txt-link-freetext" href="https://www.apereo.org/cas/protocol/login%7C%7C%7C%7Ctestuser%7C%7C%7Ctestuser%7CST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b%7C">https://www.apereo.org/cas/protocol/login||||testuser|||testuser|ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b|</a>
2620:46:8000:64:e23f:49ff:feac:5047
idp-process.log:2017-05-16 09:51:59,231 - WARN
[net.shibboleth.idp.cas.service.impl.DefaultServiceComparator:86] -
Error parsing <a class="moz-txt-link-freetext" href="https://beta.gac.edu/calendar/search/all">https://beta.gac.edu/calendar/search/all</a> employee meeting
2620:46:8000:128::16
idp-process.log:2017-05-16 09:51:59,231 - INFO
[Shibboleth-Audit.SSO:241] -
20170516T145159Z|||<a class="moz-txt-link-freetext" href="https://beta.gac.edu/calendar/search/all%20employee%20meeting%7Chttps://www.apereo.org/cas/protocol/serviceValidate%7C%7C%7C%7C%7C%7C%7C%7CST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b%7C">https://beta.gac.edu/calendar/search/all%20employee%20meeting|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1494946319196-Bg1WCnbnqjFbCDK334h6r7W9b|</a>
2620:46:8000:128::16
Double slash example
Initial request:
<a class="moz-txt-link-freetext" href="https://sso.gac.edu/idp/profile/cas/login?service=https%3A%2F%2Fbeta.gac.edu%2F%2Fregistrar%2Ffinals.php">https://sso.gac.edu/idp/profile/cas/login?service=https%3A%2F%2Fbeta.gac.edu%2F%2Fregistrar%2Ffinals.php</a>
Redirects back to:
<a class="moz-txt-link-freetext" href="https://beta.gac.edu/registrar/finals.php?ticket=ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI">https://beta.gac.edu/registrar/finals.php?ticket=ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI</a>
Log file has:
idp-audit.log:20170516T151412Z|||<a class="moz-txt-link-freetext" href="https://beta.gac.edu//registrar/finals.php%7Chttps://www.apereo.org/cas/protocol/login%7C%7C%7C%7Ctestuser%7C%7C%7Ctestuser%7CST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI%7C%7C2620:46:8000:64:e23f:49ff:feac:5047%7C">https://beta.gac.edu//registrar/finals.php|https://www.apereo.org/cas/protocol/login||||testuser|||testuser|ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI||2620:46:8000:64:e23f:49ff:feac:5047|</a>
idp-audit.log:20170516T151412Z|||<a class="moz-txt-link-freetext" href="https://beta.gac.edu/registrar/finals.php%7Chttps://www.apereo.org/cas/protocol/serviceValidate%7C%7C%7C%7C%7C%7C%7C%7CST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI%7C%7C2620:46:8000:128::16%7C">https://beta.gac.edu/registrar/finals.php|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI||2620:46:8000:128::16|</a>
idp-process.log:2017-05-16 10:14:12,755 - INFO
[net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] -
Granted service ticket for <a class="moz-txt-link-freetext" href="https://beta.gac.edu//registrar/finals.php">https://beta.gac.edu//registrar/finals.php</a>
2620:46:8000:64:e23f:49ff:feac:5047
idp-process.log:2017-05-16 10:14:12,756 - INFO
[Shibboleth-Audit.SSO:241] -
20170516T151412Z|||<a class="moz-txt-link-freetext" href="https://beta.gac.edu//registrar/finals.php%7Chttps://www.apereo.org/cas/protocol/login%7C%7C%7C%7Ctestuser%7C%7C%7Ctestuser%7CST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI%7C">https://beta.gac.edu//registrar/finals.php|https://www.apereo.org/cas/protocol/login||||testuser|||testuser|ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI|</a>
2620:46:8000:64:e23f:49ff:feac:5047
idp-process.log:2017-05-16 10:14:12,796 - INFO
[Shibboleth-Audit.SSO:241] -
20170516T151412Z|||<a class="moz-txt-link-freetext" href="https://beta.gac.edu/registrar/finals.php%7Chttps://www.apereo.org/cas/protocol/serviceValidate%7C%7C%7C%7C%7C%7C%7C%7CST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI%7C">https://beta.gac.edu/registrar/finals.php|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1494947652754-6ygj50tiVewAVcV6R1IWo4YrI|</a>
2620:46:8000:128::16
</pre>
</blockquote>
</p>
<p><br>
</p>
<p>Thanks,</p>
<p> Dan Oachs</p>
<p> Gustavus Adolphus College</p>
<p><br>
</p>
</body>
</html>