<div dir="ltr"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">In your example, assuming what you have in the entity ID is what the<br>
CAS client is emitting for the service URL, then you would need<br>
something like the following in the metadata:<br>
<br>
<AssertionConsumerService<br>
                Binding="<a href="https://www.apereo.org/cas/protocol/login" rel="noreferrer" target="_blank">https://www.apereo.org/cas/protocol/login</a>"<br>
                Location="<a href="https://testing.vialivetext.com/auth/cas/callback" rel="noreferrer" target="_blank">https://testing.vialivetext.com/auth/cas/callback</a>"<br>
                index="1"/><br></blockquote><div><br></div><div>It doesn't even appear to try the metadata.  It falls right through to the service registry.</div><div><br></div><div>Here's the applicable configuration.</div><div><br></div><div>metadata-providers.xml:<br>    <MetadataProvider id="cas" xsi:type="FilesystemMetadataProvider" indexesRef="shibboleth.CASMetadataIndices" metadataFile="%{idp.home}/metadata/cas.xml"/><br><br>cas.xml:<br>  <EntityDescriptor entityID="<a href="https://testing.vialivetext.com/auth/cas/callback">https://testing.vialivetext.com/auth/cas/callback</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br>          <SPSSODescriptor protocolSupportEnumeration="<a href="https://www.apereo.org/cas/protocol">https://www.apereo.org/cas/protocol</a>"><br>                    <SingleLogoutService<br>                                       Binding="<a href="https://www.apereo.org/cas/protocol/logout">https://www.apereo.org/cas/protocol/logout</a>"<br>                                 Location="urn:mace:shibboleth:profile:CAS:logout"/><br>                      <AssertionConsumerService<br>                                  Binding="<a href="https://www.apereo.org/cas/protocol/login">https://www.apereo.org/cas/protocol/login</a>"<br>                                   Location="<a href="https://testing.vialivetext.com/auth/cas/callback">https://testing.vialivetext.com/auth/cas/callback</a>"<br>                                  index="1"/><br>              </SPSSODescriptor><br>      </EntityDescriptor><br></div><div><br></div><div>Acc'd to the logs, it seems to load ok.</div><div>2019-05-31 14:20:25,444 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:350] -  - Metadata Resolver FilesystemMetadataResolver cas: Beginning refresh of metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,445 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:357] -  - Metadata Resolver FilesystemMetadataResolver cas: Processing new metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,446 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:487] -  - Metadata Resolver FilesystemMetadataResolver cas: Unmarshalling metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,467 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:531] -  - Metadata Resolver FilesystemMetadataResolver cas: Preprocessing metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,468 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:376] -  - Metadata Resolver FilesystemMetadataResolver cas: Applying metadata filter<br>2019-05-31 14:20:25,532 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:541] -  - Metadata Resolver FilesystemMetadataResolver cas: Releasing cached DOM for metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,532 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:545] -  - Metadata Resolver FilesystemMetadataResolver cas: Post-processing metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,533 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:549] -  - Metadata Resolver FilesystemMetadataResolver cas: Computing expiration time for metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,534 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:554] -  - Metadata Resolver FilesystemMetadataResolver cas: Expiration of metadata from '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml' will occur at 2019-05-31T22:20:25.444Z<br>2019-05-31 14:20:25,534 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:574] -  - Metadata Resolver FilesystemMetadataResolver cas: New metadata successfully loaded for '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml'<br>2019-05-31 14:20:25,535 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] -  - Metadata Resolver FilesystemMetadataResolver cas: Next refresh cycle for metadata provider '/usr/local/mcomm/shibboleth-idp/metadata/cas.xml' will occur on '2019-05-31T21:20:25.466Z' ('2019-05-31T17:20:25.466-04:00' local time)</div><div><br></div><div><br></div><div>I want to use metadata, but since it seems to want to use the service resigstry,  for testing purposes, I made the rules in cas-protocol.xml fit vendor's hostname...</div><div>    <bean id="reloadableServiceRegistry"<br>          class="%{idp.cas.serviceRegistryClass:net.shibboleth.idp.cas.service.PatternServiceRegistry}"><br>        <property name="definitions"><br>            <list><br>                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"<br>                      c:regex="https://([A-Za-z0-9_-]+\.)*vialivetext\.org(:\d+)?/.*"<br>                      p:group="proxying-services"<br>                      p:authorizedToProxy="true"<br>                      p:singleLogoutParticipant="true" /><br>                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"<br>                      c:regex="http://([A-Za-z0-9_-]+\.)*vialivetext\.org(:\d+)?/.*"<br>                      p:group="non-proxying-services"<br>                      p:authorizedToProxy="false" /><br>            </list><br>        </property><br>    </bean><br></div><div><br></div><div>And the IDP is throws the OOB..</div><div>2019-05-31 14:23:58,935 - DEBUG [net.shibboleth.idp.cas.flow.impl.BuildRelyingPartyContextAction:103] - x.x.x.x - Querying net.shibboleth.idp.cas.service.impl.MetadataServiceRegistry for CAS service URL <a href="https://testing.vialivetext.com/auth/cas/callback?organization_id=1234567890abc&redirect_url=&url">https://testing.vialivetext.com/auth/cas/callback?organization_id=1234567890abc&redirect_url=&url</a><br>2019-05-31 14:23:58,951 - ERROR [net.shibboleth.idp.cas:-2] - x.x.x.x - Uncaught runtime exception<br>java.lang.ArrayIndexOutOfBoundsException: 1<br>    at net.shibboleth.utilities.java.support.net.URLBuilder.<init>(URLBuilder.java:119)<br>2019-05-31 14:23:58,977 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - x.x.x.x - A non-proceed event occurred while processing the request: RuntimeException<br>2019-05-31 14:23:59,021 - INFO [Shibboleth-Audit.SSO:275] - x.x.x.x - 20190531T182359Z||||<a href="https://www.apereo.org/cas/protocol/login|||||||||">https://www.apereo.org/cas/protocol/login|||||||||</a><br></div><div><br></div><div>I'm not sure what else to try.  The configuration options from the vendor are very limited.</div><div><br></div><div>Liam</div></div></div>