Morning, Are there any (somewhat) supported CAS clients for Apache httpd (2.2) on Windows?
A security update to Apache httpd 2.4 for CVE-2016-8743 broke some of our legacy Windows CAS clients, specifically those with old versions of mod_auth_cas running on Windows with httpd 2.2. Service-validate requests against our (httpd 2.4-proxied) CAS servers are rejected with 400 because these clients send non-conforming (RFC 7230, ...) HTTP requests with line ends containing only a newlines (vs. CR-NL). I.e. Apache httpd is no longer "tolerant" (in the RFC 2616 sense). I haven't found what exactly is broken because those who contacted us about this are non-technical and guessed at the mod_auth_cas version. Older versions of mod_auth_cas look to have directly composed HTTP requests, while later versions delegated to the cURL library. I'd like to get an idea of what's suported before I send these clients on a goose chase to find technical staff to rebuild Window mod_auth_cas with updated libraries. phpCAS perhaps (assuming it can e.g. inject REMOTE_USER into the environment)? Thanks. Tom. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/21AF82E9-D313-4657-ABFF-2FCEAA651E30%40ucdavis.edu.
