Make sure service ticket not expiring by time , service ticket not expiring by max number of uses reached , service ticket not expiring because ticket granting ticket is expired (happens).
Logging out parent ticket granting ticket clears all children service tickets that is a possible cause of not recognizing a service ticket just created. > On 18 Aug 2017, at 15:20, thomas <[email protected]> wrote: > > hi tom, > > It is a copy/paste error i've done > correct call is : > > https://int-sso.example.com/cas/p3/serviceValidate?ticket=ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com&service=https%3A%2F%2Fapp.example.com%2Flogin > > > > I use memcache for ticket registry. > > Le vendredi 18 août 2017 09:52:24 UTC+2, thomas a écrit : > Hi all, > > > I'm facing a problem of ticket validating on cas 4.2.7. > > I do tests with curl. > > There is the steps I do to reproduce problem : > > 1/Login and get TGT > curl -X POST https://int-sso.example.com/cas/v1/tickets -d > "username=xxx&password=xxx" > --> I catch TGT : > TGT-14-scrMLORgxLfThHRCOnVh66wI2f9DrPOzSasCRfseSECZnGcXM4-int-sso.example.com > Get ST according to TGT > > curl -X POST > https://int-sso.example.com/cas/v1/tickets/TGT-14-scrMLORgxLfThHRCOnVh66wI2f9DrPOzSasCRfseSECZnGcXM4-int-sso.example.com > -d "service=https%3A%2F%2Fapp.example.com%2Flogin" > --> I catch ST : ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com > > Finally, I ask CAS to validate my ticket, and I always have same answer : > > Call : > https://int-sso.example.com/cas/p3/serviceValidate?ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com&service=https%3A%2F%2Fapp.example.com%2Flogin > > > response : > > <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'> > <cas:authenticationFailure code='INVALID_TICKET'> > Ticket > 'ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com' not recognized > </cas:authenticationFailure> > </cas:serviceResponse> > > > And in catalina.out, I have the same thing : > > > .... > > ============================================================= > WHO: audit:unknown > WHAT: > TGT-***********************************************t0Tc3Y9B3x-int-sso.example.com > > ACTION: TICKET_GRANTING_TICKET_CREATED > APPLICATION: CAS > WHEN: Thu Aug 17 16:49:11 CEST 2017 > CLIENT IP ADDRESS: xxx > SERVER IP ADDRESS: 172.20.1.8 > ============================================================= > > ... > > ============================================================= > WHO: [email protected] > WHAT: ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com for > https://app.example.com/login > ACTION: SERVICE_TICKET_CREATED > APPLICATION: CAS > WHEN: Thu Aug 17 16:49:42 CEST 2017 > CLIENT IP ADDRESS: xxx > SERVER IP ADDRESS: 172.20.1.8 > ============================================================= > ... > > 2017-08-17 16:50:09,663 DEBUG > [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver] - <Resolving > argument [String] for audit> > 2017-08-17 16:50:09,663 DEBUG > [org.jasig.cas.CentralAuthenticationServiceImpl] - <Ticket > [ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com] by type [Ticket] cannot be > found in the ticket registry.> > 2017-08-17 16:50:09,665 DEBUG > [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver] - <Could not > locate ticket [ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com] in the > registry> > 2017-08-17 16:50:09,665 INFO > [org.jasig.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit > trail record BEGIN > ============================================================= > WHO: audit:unknown > WHAT: ST-1764-1lAgfQwbrmpIsp5c2kcT-int-sso.example.com > ACTION: SERVICE_TICKET_VALIDATE_FAILED > APPLICATION: CAS > WHEN: Thu Aug 17 16:50:09 CEST 2017 > CLIENT IP ADDRESS: xxx > SERVER IP ADDRESS: 172.20.1.8 > ============================================================= > > > Am I doing something wrong ? > > Thanks > > -- > > Thomas > > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/02dbea15-3484-4600-ae6b-5f48d0d20070%40apereo.org. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/DC6C4FCB-8D2A-4640-B1D4-DBEB8F09D503%40madiva.com.
