CAS 6.3.5 with Duo, double login / NCName issue

[Michael Hodges]

Since upgrading CAS apps are sporadically requiring users to login twice in a row.  One of the app error log snippets includes the following.  We are unable to reproduce the issue at will and hoping that someone recognizes this and can provide info.  TIA - Michael

2021-Aug-16 05:08:19 ERROR org.opensaml.SAMLObject - caught an exception while parsing a stream: cvc-datatype-valid.1.2.1: '1cd276bb-3545-4f46-b1ee-629e66453b85' is not a valid value for 'NCName'. 2021-Aug-16 05:08:19 DEBUG org.springframework.security.cas.web.CasAuthenticationFilter - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 243; cvc-datatype-valid.1.2.1: '1cd276bb-3545-4f46-b1ee-629e66453b85' is not a valid value for 'NCName'. org.springframework.security.authentication.BadCredentialsException: org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 243; cvc-datatype-valid.1.2.1: '1cd276bb-3545-4f46-b1ee-629e66453b85' is not a valid value for 'NCName'.

[Michael Hodges]

In our case the issue was primarily due to the apps utilizing older CAS clients, forcing the apps to update the clients.