<div dir="ltr"><div>So, I found the root cause for this issue.<br><br>During login, HttpServletRequest.getRequestUrl() returns <a href="https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1">https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1</a>, but during validation it returns <a href="https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&entityId=https://sju.zoom.us">https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&entityId=https://sju.zoom.us</a> because CAS always redirects to the service URL (with the service ticket in tow) upon successful login. When Shibcas constructs the service URL it appends the entity ID in either situation, resulting in the doubled-up embedded entity ID.<br><br></div>I've successfully tested a simple patch for this, overloading the method ShibcasAuthServlet.constructServiceUrl() to take a boolean indicating whether or not a ticket is being validated; if true, it'll return the string from CommonUtils unmodified.<br><br>----&<----<br>--- /var/tmp/shib-cas-authn3-master/src/main/java/net/unicon/idp/externalauth/ShibcasAuthServlet.java 2017-05-01 18:48:21.000000000 -0400<br>+++ shib-cas-authn3-master/src/main/java/net/unicon/idp/externalauth/ShibcasAuthServlet.java 2017-08-01 16:33:25.707861000 -0400<br>@@ -93,7 +93,7 @@<br> final String authenticationKey, final boolean force) throws ExternalAuthenticationException, IOException {<br> try {<br> ticketValidator.setRenew(force);<br>- String serviceUrl = constructServiceUrl(request, response);<br>+ String serviceUrl = constructServiceUrl(request, response, true);<br> logger.debug("validating ticket: {} with service url: {}", ticket, serviceUrl);<br><br> Assertion assertion = ticketValidator.validate(ticket, serviceUrl);<br>@@ -255,6 +255,18 @@<br> return serviceUrl;<br> }<br><br>+ /**<br>+ * Like the above, but with a flag indicating whether we're validating a service ticket,<br>+ * in which case we should not modify the service URL returned by CAS CommonUtils; this<br>+ * avoids appending the entity ID twice when entityIdLocation=embed, since the ID is already<br>+ * embedded in the string during validation.<br>+ */<br>+ private String constructServiceUrl(final HttpServletRequest request, final HttpServletResponse response, final boolean isValidatingTicket ) {<br>+ return isValidatingTicket<br>+ ? CommonUtils.constructServiceUrl(request, response, null, serverName, serviceParameterName, artifactParameterName, true)<br>+ : constructServiceUrl(request, response);<br>+ }<br>+<br> private void loadErrorPage(final HttpServletRequest request, final HttpServletResponse response) {<br> RequestDispatcher requestDispatcher = request.getRequestDispatcher("/no-conversation-state.jsp");<br> try {<br>----8<----<br><br><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><p>Best regards,<br>--<br><span style="font-family:"Baskerville Old Face","serif";color:#504e4f">Carlos M. Fernández<br>Enterprise Systems Manager</span><br><b><span style="font-family:"Baskerville Old Face","serif";color:#9b0c27">Saint Joseph’s University</span></b><br><span style="font-family:"Baskerville Old Face","serif";color:#504e4f">Philadelphia PA 19131<br>T: <span title="Call with Google Voice">+1 610 660 1501</span></span></p></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Jul 31, 2017 at 3:22 PM, Carlos Fernandez <span dir="ltr"><<a href="mailto:cfernand@sju.edu" target="_blank">cfernand@sju.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Setup: IdP 3.3.0, shib-cas-authn 3.2.2, CAS 5.0.5, CAS client 3.4.1<br><br>When shibcas.entityIdLocation=<wbr>embed, the service URL sent with the validation request differs from the one sent for the login request.<br><br>From the logs:<br>`org.jasig.cas.client.<wbr>validation.<wbr>TicketValidationException: Ticket '<a href="http://ST-8997-qwrkgYqHLZqAHEvlf2EZ-cas.sju.edu" target="_blank">ST-8997-qwrkgYqHLZqAHEvlf2EZ-<wbr>cas.sju.edu</a>' does not match supplied service. The original service was '<a href="https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&entityId=https://sju.zoom.us" target="_blank">https://cas.sju.edu/idp/<wbr>Authn/ExtCas?conversation=<wbr>e1s1&entityId=https://sju.<wbr>zoom.us</a>' and the supplied service was '<a href="https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&entityId=https%3A%2F%2Fsju.zoom.us&entityId=https://sju.zoom.us'." target="_blank">https://cas.sju.edu/idp/<wbr>Authn/ExtCas?conversation=<wbr>e1s1&entityId=https%3A%2F%<wbr>2Fsju.zoom.us&entityId=<wbr>https://sju.zoom.us'.`</a><br><br>The validation service URL appears to have the entityID embedded twice, which CAS flags as invalid and refuses to validate. This results in our IdP returning an AuthnFailed to the SP (we don't have any other authn methods in our IdP).<br><br></div>From rifling through the code a bit, it seems that the CAS CommonUtils class returns a service URL with the entityID already embedded when the browser returns from login with the service ticket, after which ShibCAS embeds the entityID again.<br><br></div>Has anyone else run into this issue? I think this might not be an issue with older CAS releases -- I know from experience that CAS 3.5 doesn't care about the service URL during validation, which we discovered when we upgraded to CAS 5.0.5 and one of our applications no longer worked.<br clear="all"><div><div><div><div><div class="m_8136878277045049163gmail_signature"><div dir="ltr"><div><div dir="ltr"><p>Best regards,<br>--<br><span style="font-family:"Baskerville Old Face","serif";color:rgb(80,78,79)">Carlos M. Fernández<br>Enterprise Systems Manager</span><br><b><span style="font-family:"Baskerville Old Face","serif";color:rgb(155,12,39)">Saint Joseph’s University</span></b><br><span style="font-family:"Baskerville Old Face","serif";color:rgb(80,78,79)">Philadelphia PA 19131<br>T: <span title="Call with Google Voice">+1 610 660 1501</span></span></p></div></div></div></div></div>
</div></div></div></div>
</blockquote></div><br></div>