One of our testers has turned up the following, which has us stumped. > Here are the steps: > - visit https://example.edu/app > - login (user is prompted for username/password) > - it should work the first time > - visit https://example.edu/app again > - logout from /app (note we don't specifically try to logout of cas, but we > do attempt to kill session) > - login again (via SSO, user authenticates without having to provide > username/password) > - this time you'll get the bad ticket
In our logs we can see the initial authentication and issue of the TGT. CAS issues the first ST and it is successfully validated. We then see the second ST issued, and it too is logged as being successfully validated: ============================================================= WHO: user WHAT: ST-405-pPGJm7dUt9mFXX2rggY0-cas for https://example.edu/support/app ACTION: SERVICE_TICKET_CREATED APPLICATION: CAS WHEN: Mon Oct 10 16:33:11 HST 2016 CLIENT IP ADDRESS: 10.10.10.222 SERVER IP ADDRESS: 10.10.10.22 ============================================================= ============================================================= WHO: user WHAT: ST-405-pPGJm7dUt9mFXX2rggY0-cas ACTION: SERVICE_TICKET_VALIDATED APPLICATION: CAS WHEN: Mon Oct 10 16:33:11 HST 2016 CLIENT IP ADDRESS: 10.10.10.222 SERVER IP ADDRESS: 10.10.10.22 ============================================================= but /app is seeing the response Ticket 'ST-405-pPGJm7dUt9mFXX2rggY0-cas' not recognized and this is logged WARN [org.apereo.cas.web.ServiceValidateController] - <Service ticket [ST-405-pPGJm7dUt9mFXX2rggY0-cas] does not satisfy validation specification.> (I'm trying to figure out how to increase logging for .ServiceValidateController but haven't been successful yet). -baron -- Baron Fujimoto <[email protected]> :: UH Information Technology Services minutas cantorum, minutas balorum, minutas carboratum desendus pantorum -- CAS gitter chatroom: https://gitter.im/apereo/cas CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html CAS documentation website: https://apereo.github.io/cas CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/20161011030716.GR23083%40praenomen.mgt.hawaii.edu. For more options, visit https://groups.google.com/a/apereo.org/d/optout.
