{"action":"created","issue":{"url":"https://api.github.com/repos/Unicon/shib-cas-authn3/issues/26","repository_url":"https://api.github.com/repos/Unicon/shib-cas-authn3","labels_url":"https://api.github.com/repos/Unicon/shib-cas-authn3/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/Unicon/shib-cas-authn3/issues/26/comments","events_url":"https://api.github.com/repos/Unicon/shib-cas-authn3/issues/26/events","html_url":"https://github.com/Unicon/shib-cas-authn3/issues/26","id":247197409,"number":26,"title":"Different service URLs between login and validation when entityIdLocation=embed","user":{"login":"aremmes","id":30127293,"avatar_url":"https://avatars0.githubusercontent.com/u/30127293?v=4","gravatar_id":"","url":"https://api.github.com/users/aremmes","html_url":"https://github.com/aremmes","followers_url":"https://api.github.com/users/aremmes/followers","following_url":"https://api.github.com/users/aremmes/following{/other_user}","gists_url":"https://api.github.com/users/aremmes/gists{/gist_id}","starred_url":"https://api.github.com/users/aremmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aremmes/subscriptions","organizations_url":"https://api.github.com/users/aremmes/orgs","repos_url":"https://api.github.com/users/aremmes/repos","events_url":"https://api.github.com/users/aremmes/events{/privacy}","received_events_url":"https://api.github.com/users/aremmes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-08-01T20:50:44Z","updated_at":"2017-08-14T17:23:35Z","closed_at":null,"body":"Setup: IdP 3.3.0, shib-cas-authn 3.2.2, CAS 5.0.5\r\n\r\nWhen shibcas.entityIdLocation=embed, the service URL sent with the validation request differs from the one sent for the login request.\r\n\r\nFrom the logs:\r\n`org.jasig.cas.client.validation.TicketValidationException: Ticket 'ST-8997-qwrkgYqHLZqAHEvlf2EZ-cas.sju.edu' does not match supplied service. The original service was 'https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&amp;entityId=https://sju.zoom.us' and the supplied service was 'https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&amp;entityId=https%3A%2F%2Fsju.zoom.us&amp;entityId=https://sju.zoom.us'.`\r\n\r\nThe validation service URL appears to have the entityID embedded twice, which CAS flags as invalid and refuses to validate. This results in our IdP returning an AuthnFailed to the SP (we don't have any other authn methods in our IdP). From rifling through the code a bit, it seems that the CAS CommonUtils class returns a service URL with the entityID already embedded when the browser returns from login with the service ticket, after which ShibCAS embeds the entityID again. Namely,  HttpServletRequest.getRequestUrl() returns https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1, but during validation it returns https://cas.sju.edu/idp/Authn/ExtCas?conversation=e1s1&amp;entityId=https://sju.zoom.us because CAS always redirects to the service URL (with the service ticket in tow) upon successful login. When Shibcas constructs the service URL it appends the entity ID in either situation, resulting in the doubled-up embedded entity ID.\r\n\r\nI've successfully tested a simple patch for this, overloading the method ShibcasAuthServlet.constructServiceUrl() to take a boolean indicating whether or not a ticket is being validated; if true, it'll return the string from CommonUtils unmodified (attached below).\r\n\r\n[shib-cas-authn3-ShibcasAuthServlet.txt](https://github.com/Unicon/shib-cas-authn3/files/1191884/shib-cas-authn3-ShibcasAuthServlet.txt)\r\n"},"comment":{"url":"https://api.github.com/repos/Unicon/shib-cas-authn3/issues/comments/322252867","html_url":"https://github.com/Unicon/shib-cas-authn3/issues/26#issuecomment-322252867","issue_url":"https://api.github.com/repos/Unicon/shib-cas-authn3/issues/26","id":322252867,"user":{"login":"jtgasper3","id":1022508,"avatar_url":"https://avatars2.githubusercontent.com/u/1022508?v=4","gravatar_id":"","url":"https://api.github.com/users/jtgasper3","html_url":"https://github.com/jtgasper3","followers_url":"https://api.github.com/users/jtgasper3/followers","following_url":"https://api.github.com/users/jtgasper3/following{/other_user}","gists_url":"https://api.github.com/users/jtgasper3/gists{/gist_id}","starred_url":"https://api.github.com/users/jtgasper3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtgasper3/subscriptions","organizations_url":"https://api.github.com/users/jtgasper3/orgs","repos_url":"https://api.github.com/users/jtgasper3/repos","events_url":"https://api.github.com/users/jtgasper3/events{/privacy}","received_events_url":"https://api.github.com/users/jtgasper3/received_events","type":"User","site_admin":false},"created_at":"2017-08-14T17:23:35Z","updated_at":"2017-08-14T17:23:35Z","body":"Yep, this looks like a bug. I'll look at the code changes the next time I break open the code."}}
{"actor":{"display_login":"jtgasper3"}}