Thomas, This doesn’t look quite right at first glance:
Call : https://int-sso.example.com/cas/p3/serviceValidate?ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com&service=https%3A%2F%2Fapp.example.com%2Flogin You have a service parameter and you’ve got the service ticket but you should have a ticket parameter. It does appear that CAS is checking the registry for your ticket anyways but the parameter isn’t listed as optional. In addition, what are you using for your ticket registry? Thanks, Tom From: [email protected] [mailto:[email protected]] On Behalf Of thomas Sent: Friday, August 18, 2017 3:52 AM To: CAS Community <[email protected]> Subject: [cas-user] CAS 4.2.7 ticket validating failed Hi all, I'm facing a problem of ticket validating on cas 4.2.7. I do tests with curl. There is the steps I do to reproduce problem : 1/Login and get TGT curl -X POST https://int-sso.example.com/cas/v1/tickets -d "username=xxx&password=xxx" --> I catch TGT : TGT-14-scrMLORgxLfThHRCOnVh66wI2f9DrPOzSasCRfseSECZnGcXM4-int-sso.example.com Get ST according to TGT curl -X POST https://int-sso.example.com/cas/v1/tickets/TGT-14-scrMLORgxLfThHRCOnVh66wI2f9DrPOzSasCRfseSECZnGcXM4-int-sso.example.com -d "service=https%3A%2F%2Fapp.example.com%2Flogin" --> I catch ST : ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com Finally, I ask CAS to validate my ticket, and I always have same answer : Call : https://int-sso.example.com/cas/p3/serviceValidate?ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com&service=https%3A%2F%2Fapp.example.com%2Flogin response : <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'> <cas:authenticationFailure code='INVALID_TICKET'> Ticket 'ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com' not recognized </cas:authenticationFailure> </cas:serviceResponse> And in catalina.out, I have the same thing : .... ============================================================= WHO: audit:unknown WHAT: TGT-***********************************************t0Tc3Y9B3x-int-sso.example.com ACTION: TICKET_GRANTING_TICKET_CREATED APPLICATION: CAS WHEN: Thu Aug 17 16:49:11 CEST 2017 CLIENT IP ADDRESS: xxx SERVER IP ADDRESS: 172.20.1.8 ============================================================= ... ============================================================= WHO: [email protected]<mailto:[email protected]> WHAT: ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com for https://app.example.com/login ACTION: SERVICE_TICKET_CREATED APPLICATION: CAS WHEN: Thu Aug 17 16:49:42 CEST 2017 CLIENT IP ADDRESS: xxx SERVER IP ADDRESS: 172.20.1.8 ============================================================= ... 2017-08-17 16:50:09,663 DEBUG [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver] - <Resolving argument [String] for audit> 2017-08-17 16:50:09,663 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Ticket [ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com] by type [Ticket] cannot be found in the ticket registry.> 2017-08-17 16:50:09,665 DEBUG [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver] - <Could not locate ticket [ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com] in the registry> 2017-08-17 16:50:09,665 INFO [org.jasig.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN ============================================================= WHO: audit:unknown WHAT: ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com ACTION: SERVICE_TICKET_VALIDATE_FAILED APPLICATION: CAS WHEN: Thu Aug 17 16:50:09 CEST 2017 CLIENT IP ADDRESS: xxx SERVER IP ADDRESS: 172.20.1.8 ============================================================= Am I doing something wrong ? Thanks -- Thomas -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1f90af6f-8ebf-43d4-a9c0-94455bc3ab13%40apereo.org<https://groups.google.com/a/apereo.org/d/msgid/cas-user/1f90af6f-8ebf-43d4-a9c0-94455bc3ab13%40apereo.org?utm_medium=email&utm_source=footer>. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CY4PR02MB2773E10E73189E590692ADB3CB800%40CY4PR02MB2773.namprd02.prod.outlook.com.
