CAS 5.3.x Introduces Breaking Change for RequestID in cas-server-support-saml

118 views
Skip to first unread message

Josh G

unread,
Aug 27, 2018, 3:25:32 PM8/27/18
to CAS Community

CAS 5.3.x introduces a breaking change to how RequestIDs are handled when validating SAML Services.

In 5.2.x (and all previous version of CAS), if the RequestID is not present, it will gracefully fail by returning a null value:





requestId = extractRequestId(requestBody);

/**
 * Extract request id from the body.
 *
 * @param requestBody the request body
 * @return the string
 */
private static String extractRequestId(final String requestBody) {
    if (!requestBody.contains("RequestID")) {
        LOGGER.debug("Request body does not contain a request id");
        return null;
    }

    try {
        final int position = requestBody.indexOf("RequestID=\"") + CONST_REQUEST_ID_LENGTH;
        final int nextPosition = requestBody.indexOf('"', position);

        return requestBody.substring(position, nextPosition);
    } catch (final Exception e) {
        LOGGER.debug("Exception parsing RequestID from request.", e);
        return null;
    }
}
     


In 5.3.x, if the RequestID is not present it will throw a NullPointerException:



@NonNull
final Attribute requestIdAttribute = requestChild.getAttribute("RequestID");
requestId = requestIdAttribute.getValue();


This change will break all versions of apereo/mod_auth_cas (See: https://github.com/apereo/mod_auth_cas/issues/148) along with any other client that does not properly implement support for the RequestID parameter.

This change should be reverted (this is as simple as removing the @NonNull Lombok annotation so the request will failback to a null response). Breaking every install of mod_auth_cas along with other legacy clients cannot be considered acceptable.

Josh G

unread,
Sep 2, 2018, 9:29:23 PM9/2/18
to CAS Community
Its worth mentioning this issue is related to the following from July:


I'd like to reiterate that patching the client is not a fix here, the core of 5.3 needs to be patched to gracefully accept a null RequestID as all previous versions of CAS have.

Curtis Ruck

unread,
Sep 6, 2018, 4:04:15 PM9/6/18
to CAS Community
or at least have a boolean that can be flipped to disable this.

Josh G

unread,
Sep 7, 2018, 7:12:54 AM9/7/18
to CAS Community
I agree. That would work just as well.

We're now stuck at 5.2.x and cannot move forward until this is patched. We have too many external vendor integrations that are impacted by this.

Josh G

unread,
Oct 2, 2018, 7:12:28 AM10/2/18
to CAS Community
It looks like this is patched in the latest 5.3.x branch! Big thanks to Misagh Moayyed! We will validate on the next release.

Reply all
Reply to author
Forward
0 new messages