The ServiceValidate endpoint can only validate Service Tickets. ProxyValidate can validate both Service Tickets and Proxy Tickets. The logic is that you need to explicitly understand that you're validating proxy tickets (because there *should* be extra work that is done to validate the chain).
On Fri, Sep 25, 2009 at 1:08 AM, tedzo <[email protected]> wrote: > Thank you for your response. > > renew was true. > > However, I was validating the ticket at /cas/serviceValidate. I changed > that to /proxyValidate and it worked fine. I thought service and proxy > tickets were the same in Cas3.0 and so used /serviceValidate. So, > /servicevalidate can only validate service tickets and /proxyValidate only > proxy tickets? If so, is there a way to tell between service and proxy > tickets? We have a authentication service that some clients use and this > service talks to CAS (authenticates using the rest service, validates > tickets). I am wondering if the authentication service needs to tweak the > url to use (/serviceValidate or /proxyValidate) depending on the type of > ticket coming in. > > Your thoughts? > > Thanks again. > > ------------------------------ > *From:* Scott Battaglia <[email protected]> > *To:* [email protected] > *Sent:* Thursday, September 24, 2009 6:52:07 PM > *Subject:* Re: [cas-user] invalid specification error during validation > > Its usually either you didn't provide renew=true when you were supposed to > or you tried to validate a proxy ticket with the service ticket validator. > > Does any of those sound correct? > > > On Thu, Sep 24, 2009 at 8:03 PM, tedzo <[email protected]> wrote: > >> Hello all, >> I get a service ticket using a PGT and pass that st to another >> application. The 2nd application attempts to validate the ticket and the >> validation fails because the ticket "does not satisfy validation >> specification." I am not sure what the issue is. I have verified that the >> service names match etc. >> >> The stack is as below. Any ideas? >> >> Thanks >> >> >> 2009-09-24 16:10:18,587 DEBUG [http-8443-2] >> registry.DefaultTicketRegistry:67 - Attempting to retrieve ticket >> [TGT-4-kGIk7G6bfb43d9nqoR1zmIC3BYRbgddKHcQgKKasssLyLCCKyb-cas] >> 2009-09-24 16:10:18,587 DEBUG [http-8443-2] >> registry.DefaultTicketRegistry:72 - Ticket >> [TGT-4-kGIk7G6bfb43d9nqoR1zmIC3BYRbgddKHcQgKKasssLyLCCKyb-cas] found in >> registry. >> 2009-09-24 16:10:18,588 DEBUG [http-8443-2] >> registry.DefaultTicketRegistry:56 - Added ticket >> [ST-8-ZWFNe2w4fcEdpdLLc1Sl-cas] to registry. >> 2009-09-24 16:10:18,589 INFO [http-8443-2] >> cas.CentralAuthenticationServiceImpl:229 - Granted service ticket >> [ST-8-ZWFNe2w4fcEdpdLLc1Sl-cas] for service [http://bling.com/portal] for >> user [https://bling.com/portal/receptor] >> 2009-09-24 16:11:18,138 DEBUG [http-8443-1] >> support.CasArgumentExtractor:52 - Extractor generated service for: >> http://bling.com/portal >> 2009-09-24 16:11:18,139 DEBUG [http-8443-1] >> registry.DefaultTicketRegistry:67 - Attempting to retrieve ticket >> [ST-8-ZWFNe2w4fcEdpdLLc1Sl-cas] >> 2009-09-24 16:11:18,139 DEBUG [http-8443-1] >> registry.DefaultTicketRegistry:72 - Ticket >> [ST-8-ZWFNe2w4fcEdpdLLc1Sl-cas] found in registry. >> 2009-09-24 16:11:18,140 DEBUG [http-8443-1] >> registry.DefaultTicketRegistry:83 - Removing ticket >> [ST-8-ZWFNe2w4fcEdpdLLc1Sl-cas] from registry >> 2009-09-24 16:11:18,140 DEBUG [http-8443-1] >> web.ServiceValidateController:148 - ServiceTicket >> [ST-8-ZWFNe2w4fcEdpdLLc1Sl-cas] does not satisfy validation >> specification. >> >> -- >> You are currently subscribed to [email protected] as: >> [email protected] >> >> >> To unsubscribe, change settings or access archives, see >> http://www.ja-sig.org/wiki/display/JSG/cas-user >> >> > -- > You are currently subscribed to [email protected] as: > [email protected] > To unsubscribe, change settings or access archives, see > http://www.ja-sig.org/wiki/display/JSG/cas-user > > > -- > You are currently subscribed to [email protected] as: > [email protected] > > To unsubscribe, change settings or access archives, see > http://www.ja-sig.org/wiki/display/JSG/cas-user > > -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user
