<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div>Hello,<br>we have enabled CAS protocol in our IdP Shibboleth 3.3.0 according to instructions in https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration<br>We have tested successfully that it works with a phpCAS client (1.3.5).<br>So far, so good.<br><br>However, we now want to use a web application which relies on an old java CAS client and it cannot successfully work with our IdP.<br>Specifically, the client is cas-client-core-3.2.1.jar.<br><br><div>My main question is: Is there any known issue between that CAS client version and IdP Shibboleth 3.3.0 ?</div><div><br></div>I have seen similar problems in the list i.e. http://shibboleth.net/pipermail/users/2015-September/023913.html where Saml11TicketValidator was reported to cause problem.<br><br>I quote the idp-process.log part (having enabled DEBUG mode in most components). As you may see, the process stops just before validation step.<br><br><font face=""courier new", courier, monaco, monospace, sans-serif">DEBUG [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:107] - Granting service ticket for http://XXXXXXXX/j_spring_cas_security_check<br>DEBUG [net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:187] - Storing ST-1510128430419-MAxoD6L6nLi1LFofMbBfOgUvy in context https://www.apereo.org/cas/protocol/login<br>INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:123] - Granted service ticket for http://XXXXXXXX/j_spring_cas_security_check<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction@16e6784f; result = null<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@203395da expression = GrantServiceTicket, resultExpression = [null]]; result = null<br>DEBUG [org.springframework.webflow.engine.ActionState:120] - Action execution [1] returned a [null] event: proceeding to the next action in the list<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@2b465abd expression = PublishProtocolResponse, resultExpression = [null]]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'PublishProtocolResponse'<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.cas.flow.impl.PublishProtocolMessageAction@3435cf80<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.cas.flow.impl.PublishProtocolMessageAction@3435cf80; result = null<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@2b465abd expression = PublishProtocolResponse, resultExpression = [null]]; result = null<br>DEBUG [org.springframework.webflow.engine.ActionState:120] - Action execution [2] returned a [null] event: proceeding to the next action in the list<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@1801f457 expression = PopulateOutboundInterceptContext, resultExpression = [null]]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'PopulateOutboundInterceptContext'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction#69ca560a'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1669] - No default init method named 'initialize' found on bean with name 'net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction#69ca560a'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction#69ca560a'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.AvailableInterceptFlows'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] - Invoking init method 'initialize' on bean with name 'PopulateOutboundInterceptContext'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'PopulateOutboundInterceptContext'<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext@649250a8<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext@649250a8; result = null<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@1801f457 expression = PopulateOutboundInterceptContext, resultExpression = [null]]; result = null<br>DEBUG [org.springframework.webflow.engine.ActionState:120] - Action execution [3] returned a [null] event: proceeding to the next action in the list<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@71e78c30 expression = PopulateClientStorageSaveContext, resultExpression = [null]]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'PopulateClientStorageSaveContext'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.ClientStorageServices'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] - Invoking init method 'initialize' on bean with name 'PopulateClientStorageSaveContext'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'PopulateClientStorageSaveContext'<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor@3789b352<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor@3789b352; result = NoSaveNeeded<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@71e78c30 expression = PopulateClientStorageSaveContext, resultExpression = [null]]; result = NoSaveNeeded<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [SetAction@3a8d7881 name = flowScope.redirectUrl, value = flowScope.serviceTicketResponse.redirectUrl]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [SetAction@3a8d7881 name = flowScope.redirectUrl, value = flowScope.serviceTicketResponse.redirectUrl]; result = success<br>DEBUG [org.springframework.webflow.engine.Transition:214] - Executing [Transition@50d888d6 on = NoSaveNeeded, to = CheckOutboundInterceptContext]<br>DEBUG [org.springframework.webflow.engine.Transition:222] - Exiting state 'GrantServiceTicket'<br>DEBUG [org.springframework.webflow.engine.DecisionState:189] - Entering state 'CheckOutboundInterceptContext' of flow 'cas/login'<br>DEBUG [org.springframework.webflow.engine.Transition:214] - Executing [Transition@216c5379 on = opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty(), to = ReturnToService]<br>DEBUG [org.springframework.webflow.engine.Transition:222] - Exiting state 'CheckOutboundInterceptContext'<br>DEBUG [org.springframework.webflow.engine.DecisionState:189] - Entering state 'ReturnToService' of flow 'cas/login'<br>DEBUG [org.springframework.webflow.engine.Transition:214] - Executing [Transition@6839db2e on = *, to = RedirectToService]<br>DEBUG [org.springframework.webflow.engine.Transition:222] - Exiting state 'ReturnToService'<br>DEBUG [org.springframework.webflow.engine.EndState:189] - Entering state 'RedirectToService' of flow 'cas/login'<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@2376871c expression = PopulateAuditContext, resultExpression = [null]]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'PopulateAuditContext'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.AuditFormattingMap'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.DefaultCASLoginAuditExtractors'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] - Invoking init method 'initialize' on bean with name 'PopulateAuditContext'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'PopulateAuditContext'<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.audit.impl.PopulateAuditContext@74485f91<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.audit.impl.PopulateAuditContext@74485f91; result = null<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@2376871c expression = PopulateAuditContext, resultExpression = [null]]; result = null<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@13d1b444 expression = WriteAuditLog, resultExpression = [null]]<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'WriteAuditLog'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.AuditFormattingMap'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.HttpServletRequest'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] - Invoking init method 'initialize' on bean with name 'WriteAuditLog'<br>DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'WriteAuditLog'<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.audit.impl.WriteAuditLog@2553d578<br>INFO [Shibboleth-Audit.SSO:241] - 20171108T080710Z|||http://XXXXXXXX/j_spring_cas_security_check|https://www.apereo.org/cas/protocol/login||||YYYYYYYY|||YYYYYYYY|ST-1510128430419-MAxoD6L6nLi1LFofMbBfOgUvy|<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.audit.impl.WriteAuditLog@2553d578; result = null<br>DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@13d1b444 expression = WriteAuditLog, resultExpression = [null]]; result = null<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing org.springframework.webflow.action.ViewFactoryActionAdapter@77840d6e<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing org.springframework.webflow.action.ExternalRedirectAction@7037d10d<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing org.springframework.webflow.action.ExternalRedirectAction@7037d10d; result = success<br>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing org.springframework.webflow.action.ViewFactoryActionAdapter@77840d6e; result = success<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.engine.Transition:235] - Completed transition execution. As a result, the flow execution has ended<br>DEBUG [org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository:131] - Removing flow execution '[Ended execution of 'cas/login']' from repository<br>DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager:100] - Ending conversation 1<br>DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager:107] - Unlocking conversation 1<br>DEBUG [org.springframework.webflow.mvc.servlet.FlowHandlerAdapter:495] - Sending external redirect to 'http://XXXXXXXX/j_spring_cas_security_check?ticket=ST-1510128430419-MAxoD6L6nLi1LFofMbBfOgUvy'<br>DEBUG [org.springframework.web.servlet.DispatcherServlet:1044] - Null ModelAndView returned to DispatcherServlet with name 'idp': assuming HandlerAdapter completed request handling<br>DEBUG [org.springframework.web.servlet.DispatcherServlet:1000] - Successfully completed request</font><br><br>And stops at this point.<br><br>Log file from the client includes:<br><font face=""courier new", courier, monaco, monospace, sans-serif">[ajp-nio-8009-exec-1] DEBUG o.j.c.c.s.SingleSignOutHandler - Recording session for token ST-1510128430419-MAxoD6L6nLi1LFofMbBfOgUvy<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.s.HashMapBackedSessionMappingStorage - Attempting to remove Session=[9CD45B6E9E0DFFF81FFEED78D363ED21]<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.s.HashMapBackedSessionMappingStorage - No mapping for session found. Ignoring.<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.v.Saml11TicketValidator - Placing URL parameters in map.<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.v.Saml11TicketValidator - Calling template URL attribute map.<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.v.Saml11TicketValidator - Loading custom parameters from configuration.<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.v.Saml11TicketValidator - Constructing validation url: https://ZZZZZZZZZ/samlValidate?TARGET=http%3A%2F%2FXXXXXXXX%2Fj_spring_cas_security_check<br>[ajp-nio-8009-exec-1] DEBUG o.j.c.c.v.Saml11TicketValidator - Retrieving response from server.<br></font><br><br>After some seconds of waiting, the browser shows an error:<br><br>HTTP Status 500 - java.net.ConnectException: Connection timed out (Connection timed out)<br>type Exception report<br>message java.net.ConnectException: Connection timed out (Connection timed out)<br>description The server encountered an internal error that prevented it from fulfilling this request.<br>exception<br><font face=""courier new", courier, monaco, monospace, sans-serif">java.lang.RuntimeException: java.net.ConnectException: Connection timed out (Connection timed out)<br> org.jasig.cas.client.validation.Saml11TicketValidator.retrieveResponseFromServer(Saml11TicketValidator.java:231)<br> org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:207)<br> org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticateNow(CasAuthenticationProvider.java:140)<br> org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticate(CasAuthenticationProvider.java:126)<br> org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)<br> org.springframework.security.cas.web.CasAuthenticationFilter.attemptAuthentication(CasAuthenticationFilter.java:242)<br> org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:76)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)<br> org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:199)<br> org.gunet.dilosdlm.security.tokenauth.CustomTokenAuthenticationFilter.doFilter(CustomTokenAuthenticationFilter.java:85)<br> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)<br> org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)<br> org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)<br> org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)<br> org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)<br> org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)<br> org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)<br> com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:168)<br> com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:233)</font><br> <br>P.S. Unfortunately I cannot update the java CAS client to a newer version because the web application is based on that particular version.<br> <br>Thank you,<br>Dimitris<br></div></div></body></html>