<div dir="ltr">Is the renew=true being sent with both the login and the serviceValidate? If I recall correctly we had issues with some CAS clients because they would do one but not the other. A strict reading of the CAS spec says it has to be present on both or neither.<div><br></div><div>For at least one client that we just flat-out couldn't get to renew properly I ended up using metadata-driven configuration to set forceAuthn=true to accomplish the same thing.</div><div><br></div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div>-- </div><div>Paul Engle</div><div>IAM Architect</div><div>Identity & Access Management</div><div><a href="mailto:pengle@rice.edu" target="_blank">pengle@rice.edu</a> 713-348-4702</div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 24, 2020 at 11:00 AM p1995s <<a href="mailto:p1995s@yahoo.com">p1995s@yahoo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">We have a CAS client that we try to setup using the renew parameter to force<br>
a re-auth. The IDP will prompt for re-auth but after entering login<br>
credentials will fail.<br>
If renew parameter is set to false the authentication is working.<br>
In the idp logs we see the following:<br>
<br>
2020-03-23 15:26:48,620 - 172.20.6.33 - DEBUG<br>
[net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:92] - Attempting to<br>
validate<br>
ST-AADXGZLDOJSXIMKVZMUYG2CTZZJWA2N7TSRVM2HXTJ6YNGONX5TSRMVNGOH55OE2XGSP4KV3BRJKY7TZGXKYAAMJOJLMUQVXK3Z7CF23S27CRLOSWUUFDAALZKZN7AWOBGM6AVYHDN4SLEM6KQUXLUH26MDX76JYFNQGMXXXW4VRCVZTJ5EU3AZYWPF3EV3CTN3S6ZXNYVZFRTDOH2MEZMTDIKFIDJHIABF25M77OU2EDBGXSWA3IVTSLVGVU6LV2YDNFGUUEW2FVEH4IGNX2ILREWIMPUGYTA6MMI53EYCXTALOTTRXODE3BAPYEPHPQHSAARLDPQ6LLPCDNMDXRWEFFLTJ7FMDT6LLNEJGP4DSFMN3QOP7OYECOZPRLHCCKHPHILTFN5HOQCER4EILG4MYMY------<br>
2020-03-23 15:26:48,621 - 172.20.6.33 - DEBUG<br>
[net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:101] - Found and<br>
removed<br>
ST-AADXGZLDOJSXIMKVZMUYG2CTZZJWA2N7TSRVM2HXTJ6YNGONX5TSRMVNGOH55OE2XGSP4KV3BRJKY7TZGXKYAAMJOJLMUQVXK3Z7CF23S27CRLOSWUUFDAALZKZN7AWOBGM6AVYHDN4SLEM6KQUXLUH26MDX76JYFNQGMXXXW4VRCVZTJ5EU3AZYWPF3EV3CTN3S6ZXNYVZFRTDOH2MEZMTDIKFIDJHIABF25M77OU2EDBGXSWA3IVTSLVGVU6LV2YDNFGUUEW2FVEH4IGNX2ILREWIMPUGYTA6MMI53EYCXTALOTTRXODE3BAPYEPHPQHSAARLDPQ6LLPCDNMDXRWEFFLTJ7FMDT6LLNEJGP4DSFMN3QOP7OYECOZPRLHCCKHPHILTFN5HOQCER4EILG4MYMY------/8ce34ad2fb1b4ac15ef9bb031b83ddd99cc5041bde951964fb236b0b455da9ea<br>
from ticket store<br>
2020-03-23 15:26:48,621 - 172.20.6.33 - INFO<br>
[net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:117] - Successfully<br>
validated<br>
ST-AADXGZLDOJSXIMKVZMUYG2CTZZJWA2N7TSRVM2HXTJ6YNGONX5TSRMVNGOH55OE2XGSP4KV3BRJKY7TZGXKYAAMJOJLMUQVXK3Z7CF23S27CRLOSWUUFDAALZKZN7AWOBGM6AVYHDN4SLEM6KQUXLUH26MDX76JYFNQGMXXXW4VRCVZTJ5EU3AZYWPF3EV3CTN3S6ZXNYVZFRTDOH2MEZMTDIKFIDJHIABF25M77OU2EDBGXSWA3IVTSLVGVU6LV2YDNFGUUEW2FVEH4IGNX2ILREWIMPUGYTA6MMI53EYCXTALOTTRXODE3BAPYEPHPQHSAARLDPQ6LLPCDNMDXRWEFFLTJ7FMDT6LLNEJGP4DSFMN3QOP7OYECOZPRLHCCKHPHILTFN5HOQCER4EILG4MYMY------<br>
for <a href="https://appnavu.wheaton.edu/applicationNavigator/login/cas" rel="noreferrer" target="_blank">https://appnavu.wheaton.edu/applicationNavigator/login/cas</a><br>
2020-03-23 15:26:48,622 - 172.20.6.33 - DEBUG<br>
[net.shibboleth.idp.cas.flow.impl.ValidateRenewAction:60] - Renew=true<br>
requested at validation time but ticket not issued with renew=true.<br>
2020-03-23 15:26:48,631 - 172.20.6.33 - WARN<br>
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: TicketNotFromRenew<br>
2020-03-23 15:26:48,651 - 172.20.6.33 - INFO [Shibboleth-Audit.SSO:275] -<br>
20200323T202648Z|||<a href="https://appnavu.wheaton.edu/applicationNavigator/login/cas%7Chttps://www.apereo.org/cas/protocol/serviceValidate%7C%7C%7C%7C%7C%7C%7C%7CST-AADXGZLDOJSXIMKVZMUYG2CTZZJWA2N7TSRVM2HXTJ6YNGONX5TSRMVNGOH55OE2XGSP4KV3BRJKY7TZGXKYAAMJOJLMUQVXK3Z7CF23S27CRLOSWUUFDAALZKZN7AWOBGM6AVYHDN4SLEM6KQUXLUH26MDX76JYFNQGMXXXW4VRCVZTJ5EU3AZYWPF3EV3CTN3S6ZXNYVZFRTDOH2MEZMTDIKFIDJHIABF25M77OU2EDBGXSWA3IVTSLVGVU6LV2YDNFGUUEW2FVEH4IGNX2ILREWIMPUGYTA6MMI53EYCXTALOTTRXODE3BAPYEPHPQHSAARLDPQ6LLPCDNMDXRWEFFLTJ7FMDT6LLNEJGP4DSFMN3QOP7OYECOZPRLHCCKHPHILTFN5HOQCER4EILG4MYMY------%7C2020-03-23" rel="noreferrer" target="_blank">https://appnavu.wheaton.edu/applicationNavigator/login/cas|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-AADXGZLDOJSXIMKVZMUYG2CTZZJWA2N7TSRVM2HXTJ6YNGONX5TSRMVNGOH55OE2XGSP4KV3BRJKY7TZGXKYAAMJOJLMUQVXK3Z7CF23S27CRLOSWUUFDAALZKZN7AWOBGM6AVYHDN4SLEM6KQUXLUH26MDX76JYFNQGMXXXW4VRCVZTJ5EU3AZYWPF3EV3CTN3S6ZXNYVZFRTDOH2MEZMTDIKFIDJHIABF25M77OU2EDBGXSWA3IVTSLVGVU6LV2YDNFGUUEW2FVEH4IGNX2ILREWIMPUGYTA6MMI53EYCXTALOTTRXODE3BAPYEPHPQHSAARLDPQ6LLPCDNMDXRWEFFLTJ7FMDT6LLNEJGP4DSFMN3QOP7OYECOZPRLHCCKHPHILTFN5HOQCER4EILG4MYMY------|<br>
2020-03-23</a> 15:26:48,660 - 172.20.6.33 - DEBUG<br>
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]<br>
- Looking up message encoder based on binding URI:<br>
urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding<br>
2020-03-23 15:26:48,685 - 172.20.6.33 - DEBUG [PROTOCOL_MESSAGE:70] - <br>
<?xml version="1.0" encoding="UTF-8"?><br>
<SOAP-ENV:Envelope<br>
xmlns:SOAP-ENV="<a href="http://schemas.xmlsoap.org/soap/envelope/" rel="noreferrer" target="_blank">http://schemas.xmlsoap.org/soap/envelope/</a>"><br>
<SOAP-ENV:Body><br>
<saml1p:Response IssueInstant="2020-03-23T20:26:48.653Z"<br>
MajorVersion="1" MinorVersion="1"<br>
<br>
ResponseID="ST-AADXGZLDOJSXIMKVZMUYG2CTZZJWA2N7TSRVM2HXTJ6YNGONX5TSRMVNGOH55OE2XGSP4KV3BRJKY7TZGXKYAAMJOJLMUQVXK3Z7CF23S27CRLOSWUUFDAALZKZN7AWOBGM6AVYHDN4SLEM6KQUXLUH26MDX76JYFNQGMXXXW4VRCVZTJ5EU3AZYWPF3EV3CTN3S6ZXNYVZFRTDOH2MEZMTDIKFIDJHIABF25M77OU2EDBGXSWA3IVTSLVGVU6LV2YDNFGUUEW2FVEH4IGNX2ILREWIMPUGYTA6MMI53EYCXTALOTTRXODE3BAPYEPHPQHSAARLDPQ6LLPCDNMDXRWEFFLTJ7FMDT6LLNEJGP4DSFMN3QOP7OYECOZPRLHCCKHPHILTFN5HOQCER4EILG4MYMY------"<br>
xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><br>
<saml1p:Status><br>
<saml1p:StatusCode Value="INVALID_TICKET"<br>
xmlns="<a href="http://www.ja-sig.org/products/cas/" rel="noreferrer" target="_blank">http://www.ja-sig.org/products/cas/</a>"/><br>
<br>
<saml1p:StatusMessage>E_TICKET_NOT_FROM_RENEW</saml1p:StatusMessage><br>
</saml1p:Status><br>
</saml1p:Response><br>
</SOAP-ENV:Body><br>
</SOAP-ENV:Envelope><br>
<br>
2020-03-23 15:26:48,695 - 172.20.6.33 - DEBUG<br>
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action<br>
RecordResponseComplete: Record response complete<br>
<br>
Any suggestions?<br>
Please help.<br>
<br>
Thanks,<br>
Paul<br>
<br>
<br>
<br>
<br>
--<br>
Sent from: <a href="https://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html" rel="noreferrer" target="_blank">https://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>