Morning,

Are there any (somewhat) supported CAS clients for Apache httpd (2.2) on 
Windows?

A security update to Apache httpd 2.4 for CVE-2016-8743 broke some of our 
legacy Windows CAS clients, specifically those with old versions of 
mod_auth_cas running on Windows with httpd 2.2. Service-validate requests 
against our (httpd 2.4-proxied) CAS servers are rejected with 400 because these 
clients send non-conforming (RFC 7230, ...) HTTP requests with line ends 
containing only a newlines (vs. CR-NL). I.e. Apache httpd is no longer 
"tolerant" (in the RFC 2616 sense).

I haven't found what exactly is broken because those who contacted us about 
this are non-technical and guessed at the mod_auth_cas version. Older versions 
of mod_auth_cas look to have directly composed HTTP requests, while later 
versions delegated to the cURL library.

I'd like to get an idea of what's suported before I send these clients on a 
goose chase to find technical staff to rebuild Window mod_auth_cas with updated 
libraries. phpCAS perhaps (assuming it can e.g. inject REMOTE_USER into the 
environment)?

Thanks.
Tom.

-- 
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/21AF82E9-D313-4657-ABFF-2FCEAA651E30%40ucdavis.edu.

Reply via email to