<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div>Hello,<br>we have enabled CAS protocol in our Shibboleth 3.3.0 according
to instructions in
https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration<br>We tried to test it with the use of phpCAS 1.3.5.<br>The ticket is granted from the idp and sent to the CAS client.<br>However, we face a problem with the response of the idp, which is "E_ILLEGAL_STATE" and the ticket is not validated!<br><br>In particular, after filling in credentials, I get in the browser:<br><br>Authentication failure: Ticket not validated<br>Reason: [INTERNAL_ERROR] CAS error: E_ILLEGAL_STATE<br><br>It is obviously an error in the server side (idp). What should I check, which log? What is E_ILLEGAL_STATE?<br>The log in idp-process.log:<br><font face=""courier new", courier, monaco, monospace, sans-serif"><br>DEBUG
[net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:107] -
Granting service ticket for http://XXXXX/example_html.php<br>EBUG
[net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:187] - Storing
ST-1507722202059-<font face=""courier new", courier, monaco, monospace, sans-serif">TDSDZcvH3VWRV8RNzXKAcC4c7</font> in context
https://www.apereo.org/cas/protocol/login<br>INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] - Granted service ticket for http://XXXXX/example_html.php<br>INFO
[Shibboleth-Audit.SSO:241] -
20171011T114322Z|||http://XXXXX/example_html.php|https://www.apereo.org/cas/protocol/login||||userYYY|||userYYY|ST-1507722202059-TDSDZcvH3VWRV8RNzXKAcC4c7| </font><br><br>And stops at this point.<br><br>The log in the CAS client (phpCAS.log) includes the response of the idp:<br><font face=""courier new", courier, monaco, monospace, sans-serif"><br>Authentication failure: Ticket not validated [AuthenticationException.php:81]<br>Reason: [INTERNAL_ERROR] CAS error: E_ILLEGAL_STATE [AuthenticationException.php:97]<br>CAS response: <?xml version="1.0" encoding="UTF-8"?><br><cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas"><br> <cas:authenticationFailure code="INTERNAL_ERROR"><br> E_ILLEGAL_STATE<br> </cas:authenticationFailure><br></cas:serviceResponse><br> [AuthenticationException.php:102]<br>exit()</font><br><br><br>P.S.
Ticket is neither validated with the use of another CAS client (Apereo
Java CAS Client). It stops at the validation step as well...<br><br>Thanks you,<br><br>Dimitris<br></div></div></body></html>