William,
The ST shouldn't be disabled immediately after login.
For an accurate functional test, I think you ought to be able to obtain the ST
from the /login response, either from a `Location` header or from scraping the
response body.
You should be able to present that ticket to the CAS /serviceValidate endpoint.
Here is a short shell script to illustrate what I mean:
#! /bin/sh
if [ -z "$1" ]; then
echo "Usage: $0 [TGT]" >&2
exit 1
fi
CAS_LOGIN=${CAS_LOGIN:-https://cas.example.net/cas/login}
SERVICE_VALIDATE=${SERVICE_VALIDATE:-https://cas.example.net/cas/serviceValidate}
SERVICE=${SERVICE:-'https://service.example.org'}
TGT="$1"
ST=$(curl -v --get --data service="$SERVICE" --cookie CASTGC="$TGT"
"$CAS_LOGIN" 2>&1 | \
grep -e '^< Location:' | grep -e ticket= | sed -e 's/^.*ticket=//' -e
's/\r//') && \
curl -v --get --data service="$SERVICE" --data ticket="$ST"
"$SERVICE_VALIDATE"
You may have to adjust endpoints, etc.
Presenting the TGT to the /serviceValidate endpoint ought to fail, I would
think.
Thanks,
Carl Waldbieser
ITS Systems Programmer
Lafayette College
----- Original Message -----
From: "William" <[email protected]>
To: "CAS Community" <[email protected]>
Cc: [email protected], [email protected], [email protected]
Sent: Tuesday, May 10, 2016 11:37:53 AM
Subject: Re: [cas-user] Re: /p3/serviceValidate returning "Ticket...not
recognized"
Dmitriy and Misagh,
I would prefer not to disable the ticket encryption. For the validation
tests (https://wiki.jasig.org/display/CAS/CAS+Functional+Tests), I need to
login through the user interface to generate a ticket. I need to be able
to take that ticket and pass it into the "/validate" or "/serviceValidate"
endpoints using this URI: /validate?service=foo&ticket=<valid ticket>
I cannot do that with a service ticket because the service ticket is
invalidated immediately after login. The only other ticket that I am aware
of is the Ticket Granting Cookie which is encrypted with jose4j (
https://bitbucket.org/b_c/jose4j/wiki/Home) encryption library. I cannot
pass an encrypted ticket into the "/validate" or "/serviceValidate"
endpoints. I have already tried this.
The functional tests (https://github.com/wcrowell/cas-functional-tests) act
as the browser. Therefore, I am limited in the information I get back from
CAS other than my login was successful.
When I login to "/cas/login" without a service parameter, then I see the
following cookies being sent back to the browser:
[TGC=eyJhbGciOiJIUzUxMiJ9.WlhsS2FHSkhZMmxQYVVwcllWaEphVXhEU214aWJVMXBUMmxLUWsxVVNUUlJNRXBFVEZWb1ZFMXFWVEpKYmpBdUxtSnRaR2hZVEZWRGRXOHhOM1ZaTkVwWk9VOTFYMmN1VkVnemEydDNOMDR5UVV4R1oxUkRVRkkxTWpaT1VsZFJUVlpEWDBKRE9XTkNiRXRWZFVGeWMwUk9Tamh5VFRSaE5uSkRNbkJUWjA1cmJ6RjVTMUpDVW5GeWR6Sm5TM2g0TmtnM1lUTnNVRzh6V25CT2JGSlpVVWN0U0RScmRGWlJTM050TTFjMWFERTNWbDlJZW5kdk0zUjNhM0UyZG1ORFVHYzRaR2t3YlRoRFEzRTBkR0pVUVU1UVNXdDJhVVpHUTNnNVdEaG9WMGROVjBGc1NFOXZhM1pIYUdkNlgxVkhUamhuTFc1eU5qaFBVVlZhYkc1TlNIUTFRMTl1WkVwVlJVTm1hMmwzWkRsbExVMDBVMFJtVERjeVJYRlhlbWRoTjJkSlJrZENYMWROYjNad1VrZHdOR2xMYlVWMlUwOTVYMkZ5ZVROVU9WRkNkVkp0YzB3NFJDMDJhQzAxWkhKaFFqUTNhVnBZZFUwd2RIWkVlSFZWTVVsUmVXZHZUakJYU1RSMWRFVjJYMHR0Y21jdU9GZFFOek5OVjI5aVVHbFhlVk0wVDNobVNrSkZadz09.7VH7BZ7i5RHbqCOCzwtszNCr4H2szYzwrar81qCt20FAPz025majx3wfNgTWWgkUVwgzRGHaLMD4tpIllYat8g;
path=/cas/; domain=localhost;secure;, JSESSIONID=looz49v4d769zgy2s5712kci;
path=/cas; domain=localhost;secure;]
I do see that when I provide a service request parameter to login, then I
see the following cookies sent back:
[JSESSIONID=namyy4m6qr9amk5c89ua1v4h; path=/cas-services;
domain=localhost;secure;, pac4jCsrfToken=ab647d9c-b38e-4fd3-aeb0-8403356c1b27;
path=/cas-services; domain=localhost]
Is there anything on the page (header or cookie) that I could use to pass
back to the "/validate" endpoint? Can I use JSESSIONID somehow to
cross-reference what the ticket(s) are?
Do the functional tests (
https://wiki.jasig.org/display/CAS/CAS+Functional+Tests) need to be
rewritten?
Regards,
William Crowell
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/78f0ccf7-ed7c-48a7-b6e5-71227270cf49%40apereo.org.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/406522921.26178684.1462897109022.JavaMail.zimbra%40lafayette.edu.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.
