<div dir="ltr"><div>Howdy all,<br></div><div><div>I'm using idp v3.3. in our test enviornment. We are attempting combine our current SSO environment which consists of a combination of </div><div>a idp v2.x server and a CAS 3.4.x server to idp 3.3. So far I've been fairly successful in my testing. I have gmail and testshib working correctly on </div><div>the shib/idp side of the house, and I have several Ellucian/Banner applications that are working correctly using the CAS protocol, and have </div><div>successfully configured DUO athentication as well. OK so much for all the success. We use CampusEAI portal (liferay backend I think). </div><div>In production it's authenticating against our CAS 3.4.x server. For testing I'm working with CampusEAI support to configure our TEST portal</div><div>to use the our new idp v.3 server's CAS funtionality and I'm not able to login successfully. As I metioned other CAS based apps are working. </div><div><br></div><div>When I attempt to login to our test portal <a href="https://mypima-stage.pima.edu">https://mypima-stage.pima.edu</a> I'm redirected to the login screen</div><div>and authenticate successfully. Then I'm sent to the portal and just get a blank screen, with a URL like </div><div>the following "<a href="https://mypima-stage.pima.edu/paf/authorize?ticket=ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti">https://mypima-stage.pima.edu/paf/authorize?ticket=ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti</a>"</div><div><br></div><div>The error on my side is </div><div>"Service issued for <a href="https://mypima-stage.pima.edu/paf/authorize">https://mypima-stage.pima.edu/paf/authorize</a> does not match <a href="https://mypima-stage.pima.edu/paf/configuration/saml">https://mypima-stage.pima.edu/paf/configuration/saml</a>"</div><div><br></div><div>The erron the portal side is </div><div>"Caused by: javax.servlet.ServletException: org.jasig.cas.client.validation.TicketValidationException: org.opensaml.SAMLException: E_SERVICE_MISMATCH </div><div>at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:194)"</div><div><br></div><div><br></div><div><br></div><div>I will list some of the log file information below along with part of an SSO Trace. Let me also add that while</div><div>researching this problem, I found a reference here "<a href="http://shibboleth.1660669.n2.nabble.com/CAS-validation-error-td7632584.html">http://shibboleth.1660669.n2.nabble.com/CAS-validation-error-td7632584.html</a>"</div><div>that appears to be very similar what I'm seeing. I have added the section to my relying party xml as suggested by Marvin Addison, and </div><div>I believe I have added correctly. Input, insight and suggestions appreciated. BTW campusEAI is also checking things on their side.</div><div><br></div><div><br></div><div><br></div><div>+++++++++++++++++ portions of relying-party.xml ++++++++++++++++++++++++++++++</div><div><br></div><div><bean id="CAS.ValidateConfiguration.default" parent="CAS.ValidateConfiguration"</div><div> p:resolveAttributes="false"></div><div> <property name="serviceComparator"></div><div> <bean class="net.shibboleth.idp.cas.service.impl.DefaultServiceComparator"</div><div> c:parameterNames="[a-z]+sessionid" /></div><div> </property></div><div> </bean></div><div><br></div><div>........</div><div><br></div><div> <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" /></div><div> <ref bean="SAML1.AttributeQuery" /></div><div> <ref bean="SAML1.ArtifactResolution" /></div><div> <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" /></div><div> <ref bean="SAML2.ECP" /></div><div> <ref bean="SAML2.Logout" /></div><div> <ref bean="SAML2.AttributeQuery" /></div><div> <ref bean="SAML2.ArtifactResolution" /></div><div> <ref bean="Liberty.SSOS" /></div><div> <ref bean="CAS.LoginConfiguration" /></div><div> <ref bean="CAS.ProxyConfiguration" /></div><div> <ref bean="CAS.ValidateConfiguration.default" /></div><div> </list></div><div> </property></div><div> </bean></div><div><br></div><div>......</div><div><br></div><div> <bean parent="RelyingPartyByGroup" c:groupNames="mypima-stage"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="CAS.LoginConfiguration" /></div><div> <bean parent="CAS.ProxyConfiguration" /></div><div> <bean parent="CAS.ValidateConfiguration.default" /></div><div> </list></div><div> </property></div><div><br></div><div>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div><div><br></div><div><br></div><div><br></div><div><br></div><div>INFO:</div><div>our idp v3.3 server: <a href="https://login-stage.pima.edu">https://login-stage.pima.edu</a></div><div>our hosted stage portal: <a href="https://mypima-stage.pima.edu">https://mypima-stage.pima.edu</a></div><div><br></div><div><br></div><div>here's what's logged.</div><div><br></div><div><br></div><div><br></div><div>idp-auduit.log</div><div><br></div><div>20180807T145441Z|||<a href="https://mypima-stage.pima.edu/paf/authorize|https://www.apereo.org/cas/protocol/login||||bmathis|||bmathis|ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti|">https://mypima-stage.pima.edu/paf/authorize|https://www.apereo.org/cas/protocol/login||||bmathis|||bmathis|ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti|</a></div><div>20180807T145442Z|||<a href="https://mypima-stage.pima.edu/paf/configuration/saml|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti|">https://mypima-stage.pima.edu/paf/configuration/saml|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti|</a></div><div><br></div><div><br></div><div><br></div><div>portion of idp-process.log</div><div><br></div><div>2018 08-07 07:54:42,631 - DEBUG [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:92] - Attempting to validate ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti</div><div>2018-08-07 07:54:42,631 - DEBUG [net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:212] - Reading ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti</div><div>2018-08-07 07:54:42,633 - DEBUG [net.shibboleth.idp.cas.ticket.impl.AbstractTicketService:244] - Attempting to delete ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti from context <a href="https://www.apereo.org/cas/protocol/login">https://www.apereo.org/cas/protocol/login</a></div><div>2018-08-07 07:54:42,633 - DEBUG [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:101] - Found and removed ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti/891c7f00018882bee354d9c952811dff949600b2d770d15d5516ee5a1f956f15 from ticket store</div><div>2018-08-07 07:54:42,633 - DEBUG [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:113] - Service issued for <a href="https://mypima-stage.pima.edu/paf/authorize">https://mypima-stage.pima.edu/paf/authorize</a> does not match <a href="https://mypima-stage.pima.edu/paf/configuration/saml">https://mypima-stage.pima.edu/paf/configuration/saml</a></div><div>2018-08-07 07:54:42,634 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.cas.flow.impl.ValidateTicketAction@56f2c3b8; result = ServiceMismatch</div><div><br></div><div><br></div><div><br></div><div><br></div><div>SSO trace of login attempt to <a href="https://mypima-stage.pima.edu">https://mypima-stage.pima.edu</a></div><div><br></div><div>+++++++++++++++++++++++++++++</div><div>GET <a href="https://mypima-stage.pima.edu/group/mycampus/home;jsessionid=46471601AEB449254D4ED5764855D75F">https://mypima-stage.pima.edu/group/mycampus/home;jsessionid=46471601AEB449254D4ED5764855D75F</a> HTTP/1.1</div><div>GET Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>jsessionid: 46471601AEB449254D4ED5764855D75F</div><div>Host: <a href="http://mypima-stage.pima.edu">mypima-stage.pima.edu</a></div><div>User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate, br</div><div>Cookie: JSESSIONID=46471601AEB449254D4ED5764855D75F; GUEST_LANGUAGE_ID=en_US; COOKIE_SUPPORT=true</div><div><br></div><div>HTTP/?.? 302 Found</div><div>Server: Apache-Coyote/1.1</div><div>Set-Cookie: JSESSIONID=6C345416FA54420EFDDD2DEF9E451E7C; Path=/; Secure; HttpOnly</div><div>GUEST_LANGUAGE_ID=en_US; Expires=Wed, 07-Aug-2019 15:00:39 GMT; Path=/; Secure</div><div>Location: <a href="https://mypima-stage.pima.edu/c/portal/login?redirect=%2Fgroup%2Fmycampus%2Fhome%3Bjsessionid%3D46471601AEB449254D4ED5764855D75F&p_l_id=2379501">https://mypima-stage.pima.edu/c/portal/login?redirect=%2Fgroup%2Fmycampus%2Fhome%3Bjsessionid%3D46471601AEB449254D4ED5764855D75F&p_l_id=2379501</a></div><div>Content-Length: 0</div><div>Date: Tue, 07 Aug 2018 15:00:39 GMT</div><div><br></div><div><br></div><div>+++++++++++++++++++++++++++++</div><div>GET <a href="https://mypima-stage.pima.edu/c/portal/login?redirect=%2Fgroup%2Fmycampus%2Fhome%3Bjsessionid%3D46471601AEB449254D4ED5764855D75F&p_l_id=2379501">https://mypima-stage.pima.edu/c/portal/login?redirect=%2Fgroup%2Fmycampus%2Fhome%3Bjsessionid%3D46471601AEB449254D4ED5764855D75F&p_l_id=2379501</a> HTTP/1.1</div><div>GET Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>redirect: /group/mycampus/home;jsessionid=46471601AEB449254D4ED5764855D75F</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>p_l_id: 2379501</div><div>Host: <a href="http://mypima-stage.pima.edu">mypima-stage.pima.edu</a></div><div>User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate, br</div><div>Cookie: JSESSIONID=6C345416FA54420EFDDD2DEF9E451E7C; GUEST_LANGUAGE_ID=en_US; COOKIE_SUPPORT=true</div><div><br></div><div>HTTP/?.? 302 Found</div><div>Server: Apache-Coyote/1.1</div><div>Location: <a href="https://login-stage.pima.edu/idp/profile/cas/login?service=https%3A%2F%2Fmypima-stage.pima.edu%2Fpaf%2Fauthorize">https://login-stage.pima.edu/idp/profile/cas/login?service=https%3A%2F%2Fmypima-stage.pima.edu%2Fpaf%2Fauthorize</a></div><div>Content-Length: 0</div><div>Date: Tue, 07 Aug 2018 15:00:39 GMT</div><div><br></div><div><br></div><div>+++++++++++++++++++++++++++++</div><div>GET <a href="https://login-stage.pima.edu/idp/profile/cas/login?service=https%3A%2F%2Fmypima-stage.pima.edu%2Fpaf%2Fauthorize">https://login-stage.pima.edu/idp/profile/cas/login?service=https%3A%2F%2Fmypima-stage.pima.edu%2Fpaf%2Fauthorize</a> HTTP/1.1</div><div>GET Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>service: <a href="https://mypima-stage.pima.edu/paf/authorize">https://mypima-stage.pima.edu/paf/authorize</a></div><div>Host: <a href="http://login-stage.pima.edu">login-stage.pima.edu</a></div><div>User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate, br</div><div>Cookie: JSESSIONID=node0i2bwjezx6fm31vsocqogin35o6.node0; UqZBpD3n=v16FbUgw@@j9y</div><div><br></div><div>HTTP/?.? 302 Found</div><div>Set-Cookie: JSESSIONID=node0pe6d5phmq50i1qgaf4nlqby0k8.node0;Path=/idp;Secure</div><div>Expires: </div><div>Cache-Control: no-store</div><div>Location: <a href="https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1">https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1</a></div><div>Content-Length: 0</div><div>Server: Jetty(9.4.11.v20180605)</div><div><br></div><div><br></div><div>+++++++++++++++++++++++++++++</div><div>GET <a href="https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1">https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1</a> HTTP/1.1</div><div>GET Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>execution: e1s1</div><div>Host: <a href="http://login-stage.pima.edu">login-stage.pima.edu</a></div><div>User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate, br</div><div>Cookie: JSESSIONID=node0pe6d5phmq50i1qgaf4nlqby0k8.node0; UqZBpD3n=v16FbUgw@@j9y</div><div><br></div><div>HTTP/?.? 200 OK</div><div>Cache-Control: no-store</div><div>Content-Type: text/html;charset=utf-8</div><div>Content-Length: 2754</div><div>Server: Jetty(9.4.11.v20180605)</div><div><br></div><div><br></div><div>+++++++++++++++++++++++++++++</div><div>POST <a href="https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1">https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1</a> HTTP/1.1</div><div>GET Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>execution: e1s1</div><div>Host: <a href="http://login-stage.pima.edu">login-stage.pima.edu</a></div><div>User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate, br</div><div>Referer: <a href="https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1">https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1</a></div><div>Cookie: JSESSIONID=node0pe6d5phmq50i1qgaf4nlqby0k8.node0; UqZBpD3n=v16FbUgw@@j9y</div><div>Content-Type: application/x-www-form-urlencoded</div><div>Content-Length: 76</div><div>POST Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>j_username: bmathis</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>j_password: xxxxxxxxxxxxxxxxxxxxx</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>_eventId_proceed: </div><div><br></div><div>HTTP/?.? 302 Found</div><div>Cache-Control: no-store</div><div>Set-Cookie: shib_idp_session=891c7f00018882bee354d9c952811dff949600b2d770d15d5516ee5a1f956f15;Path=/idp;HttpOnly</div><div>Expires: Thu, 01 Jan 1970 00:00:00 GMT</div><div>Location: <a href="https://mypima-stage.pima.edu/paf/authorize?ticket=ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti">https://mypima-stage.pima.edu/paf/authorize?ticket=ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti</a></div><div>Content-Length: 0</div><div>Server: Jetty(9.4.11.v20180605)</div><div><br></div><div><br></div><div>+++++++++++++++++++++++++++++</div><div>GET <a href="https://mypima-stage.pima.edu/paf/authorize?ticket=ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti">https://mypima-stage.pima.edu/paf/authorize?ticket=ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti</a> HTTP/1.1</div><div>GET Parameters:</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>ticket: ST-1533653680905-mYdWI7UHoJMRv1S0Nton335Ti</div><div>Host: <a href="http://mypima-stage.pima.edu">mypima-stage.pima.edu</a></div><div>User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate, br</div><div>Referer: <a href="https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1">https://login-stage.pima.edu/idp/profile/cas/login?execution=e1s1</a></div><div>Cookie: JSESSIONID=6C345416FA54420EFDDD2DEF9E451E7C; GUEST_LANGUAGE_ID=en_US; COOKIE_SUPPORT=true</div><div><br></div><div>HTTP/?.? 500 Internal Server Error</div><div>Server: Apache-Coyote/1.1</div><div>Transfer-Encoding: chunked</div><div>Date: Tue, 07 Aug 2018 15:00:45 GMT</div><div>Connection: close</div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div>
</div>