[cas-user] WebFlow execution decryption problem

367 views
Skip to first unread message

Tom Andersson

unread,
Dec 29, 2015, 6:06:28 AM12/29/15
to CAS Community
Hi,

I'm struggling with CAS 4.1.2 and webflow execution key. I'm trying to access a custom flow using url http://localhost:8080/cas/login?execution=<executionKey>&_eventId=myCustomEvent

It seems like for some reason the execution key can not be decrypted. It then tries to redirect me to an error page but it seems to start looping as it still decrypt the execution.
I'm pretty much out of ideas where to look next. Any pointers?

2015-12-29 11:24:33,589 DEBUG [org.springframework.webflow.executor.FlowExecutorImpl] - <Resuming flow execution with key '67681562-77f6-472b-8e57-d541db4847b1_AAAAIgAAABC5oRXsjZUaTdcQW/gHRrLzAAAABmFlczEyOALEnIMkQAe vcQ9T8iWgq7 9MP l598srH0vcfIX90A7AGqTEuaoJcy7FZjncLzQIrYzjl9tWVf3RT3f1mfIaIUTS70kIwz YmoK6BajIGsce8oLCfXcyuGon7IOebdomoG/RjrANJMPKyQEVVMzRQkkj94Im9i70hVDiaiXnQMuzQubN073GYuQ9hezS/jPaDEsfGMxUr3aqTD74TgiJohEvUlXD0mVt485M b f0gmuJ3ztdYo0ETo/Hjbi0k/T5wAQb5FZqOaUSXtGlzpHCztlH/igLRP3znmtrXOTf9oDwK126zkNCFhK366FYN8Bv9ch0pjyAY/hpOpA3ThQNTHJN2Zo299q62vTsgcRDssXbfmS7DqhTKGp d3O/VEpHlV9dt7YbBgOg92fuA2/OHSk6hcMjx8BFWlD2lb0Rv/QZTIqIZtzDSWd7hqwRwterePsjyNuD5VJTS0BPXXMJl12m2uvepNf9jYf7Kr8q3peEYWvvLgha9qpj37jcY f4wxit/UvTVmx60RaO6Pp6PUDjdoUEx5r5a4aHdG4lEvG4JJE5eGxvjhghIoKLJEJiX8sJTzk6iKHNLUwfmvVtN/Sa4IFyiWBkyOeL UkvbVPUqxVfYSoXEFPcz06l8CneLBiz5I 7QjdCNIxrnDq6hD/cqn3UmXX559x4Djz37vEQbH75MX06jVqyOr0jAaD4N9qvDaM5o0wnqNwf2oauOFPBCdiXJzmG T97WnQd 7Cy3hoDWp8nZsOkjrJZRqqUdoKGvwHWrjCCGTfQRLz BVjSilaz0i53M4QAJG0uZxSAoPFKIULR0dSSLBKS/vNH8Ulozq3BM35y 0AyRydTSvlpo4ZdaC yRmH1SuYfxO0jUxb9ixinnufrY2nQCy4gkoi8/dUffJ55APoRKFHyYLYLkjVVd/EMxvjo6mt4TMbczHR WENkwGSvuNSsIu9Pda uQImowX4rtjI aGqjO3b9Nqyqpm89zOtM8r0t6uDZ4Z4gZL Mi8ckbyBicERleUyq1v/e0uPzmvb9DjYdLcHGojohJHMnMrOu7rDMW>
2015-12-29 11:24:33,591 DEBUG [org.springframework.web.servlet.mvc.annotation.ResponseStatusExceptionResolver] - <Resolving exception from handler [[FlowHandlerMapping.DefaultFlowHandler@ba3201b]]: org.jasig.spring.webflow.plugin.ClientFlowExecutionRepositoryException: Error decoding flow execution>
2015-12-29 11:24:33,592 DEBUG [org.springframework.web.servlet.mvc.support.DefaultHandlerExceptionResolver] - <Resolving exception from handler [[FlowHandlerMapping.DefaultFlowHandler@ba3201b]]: org.jasig.spring.webflow.plugin.ClientFlowExecutionRepositoryException: Error decoding flow execution>
2015-12-29 11:24:33,594 DEBUG [org.springframework.web.servlet.DispatcherServlet] - <Handler execution resulted in exception - forwarding to resolved error view: ModelAndView: materialized View is [org.springframework.web.servlet.view.RedirectView: unnamed; URL [/cas/login?execution=67681562-77f6-472b-8e57-d541db4847b1_AAAAIgAAABC5oRXsjZUaTdcQW/gHRrLzAAAABmFlczEyOALEnIMkQAe+vcQ9T8iWgq7+9MP+l598srH0vcfIX90A7AGqTEuaoJcy7FZjncLzQIrYzjl9tWVf3RT3f1mfIaIUTS70kIwz+YmoK6BajIGsce8oLCfXcyuGon7IOebdomoG/RjrANJMPKyQEVVMzRQkkj94Im9i70hVDiaiXnQMuzQubN073GYuQ9hezS/jPaDEsfGMxUr3aqTD74TgiJohEvUlXD0mVt485M+b+f0gmuJ3ztdYo0ETo/Hjbi0k/T5wAQb5FZqOaUSXtGlzpHCztlH/igLRP3znmtrXOTf9oDwK126zkNCFhK366FYN8Bv9ch0pjyAY/hpOpA3ThQNTHJN2Zo299q62vTsgcRDssXbfmS7DqhTKGp+d3O/VEpHlV9dt7YbBgOg92fuA2/OHSk6hcMjx8BFWlD2lb0Rv/QZTIqIZtzDSWd7hqwRwterePsjyNuD5VJTS0BPXXMJl12m2uvepNf9jYf7Kr8q3peEYWvvLgha9qpj37jcY+f4wxit/UvTVmx60RaO6Pp6PUDjdoUEx5r5a4aHdG4lEvG4JJE5eGxvjhghIoKLJEJiX8sJTzk6iKHNLUwfmvVtN/Sa4IFyiWBkyOeL+UkvbVPUqxVfYSoXEFPcz06l8CneLBiz5I+7QjdCNIxrnDq6hD/cqn3UmXX559x4Djz37vEQbH75MX06jVqyOr0jAaD4N9qvDaM5o0wnqNwf2oauOFPBCdiXJzmG+T97WnQd+7Cy3hoDWp8nZsOkjrJZRqqUdoKGvwHWrjCCGTfQRLz+BVjSilaz0i53M4QAJG0uZxSAoPFKIULR0dSSLBKS/vNH8Ulozq3BM35y+0AyRydTSvlpo4ZdaC+yRmH1SuYfxO0jUxb9ixinnufrY2nQCy4gkoi8/dUffJ55APoRKFHyYLYLkjVVd/EMxvjo6mt4TMbczHR+WENkwGSvuNSsIu9Pda+uQImowX4rtjI+aGqjO3b9Nqyqpm89zOtM8r0t6uDZ4Z4gZL+Mi8ckbyBicERleUyq1v/e0uPzmvb9DjYdLcHGojohJHMnMrOu7rDMW&_eventId=myCustomEvent]]; model is {exception.message=Error decoding flow execution}
org.jasig.spring.webflow.plugin.ClientFlowExecutionRepositoryException: Error decoding flow execution
        at org.jasig.spring.webflow.plugin.ClientFlowExecutionRepository.getFlowExecution(ClientFlowExecutionRepository.java:95)
        at org.springframework.webflow.executor.FlowExecutorImpl.resumeExecution(FlowExecutorImpl.java:168)
        at org.springframework.webflow.mvc.servlet.FlowHandlerAdapter.handle(FlowHandlerAdapter.java:228)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:967)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:858)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:843)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.jasig.cas.security.RequestParameterPolicyEnforcementFilter.doFilter(RequestParameterPolicyEnforcementFilter.java:296)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.jasig.inspektr.common.web.ClientInfoThreadLocalFilter.doFilter(ClientInfoThreadLocalFilter.java:62)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:85)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
        at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:333)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:745)
Caused by: java.io.IOException: Decryption error
        at org.jasig.spring.webflow.plugin.EncryptedTranscoder.decode(EncryptedTranscoder.java:107)
        at org.jasig.spring.webflow.plugin.ClientFlowExecutionRepository.getFlowExecution(ClientFlowExecutionRepository.java:90)
        ... 44 more
Caused by: org.bouncycastle.crypto.DataLengthException: last block incomplete in decryption
        at org.bouncycastle.crypto.paddings.PaddedBufferedBlockCipher.doFinal(Unknown Source)
        at org.cryptacular.adapter.BufferedBlockCipherAdapter.doFinal(BufferedBlockCipherAdapter.java:65)
        at org.cryptacular.bean.AbstractBlockCipherBean.process(AbstractBlockCipherBean.java:74)
        at org.cryptacular.bean.AbstractCipherBean.decrypt(AbstractCipherBean.java:167)
        at org.jasig.spring.webflow.plugin.EncryptedTranscoder.decode(EncryptedTranscoder.java:105)
        ... 45 more



Thanks!

--
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.

Marvin Addison

unread,
Dec 29, 2015, 4:57:31 PM12/29/15
to CAS Community
It seems like for some reason the execution key can not be decrypted. It then tries to redirect me to an error page but it seems to start looping as it still decrypt the execution.

Quick sanity check looks ok. The base64 data following the underscore in the flow execution ID is the encoded ciphertext; taking the length of that data and multiplying by 3 and dividing by 4 gives a whole number, which is correct. Obviously such a simple check isn't very reassuring, but it is a sanity check that rules out obvious truncation of the execution ID.
 
I'm pretty much out of ideas where to look next. Any pointers?

I'd rule out URL encoding errors before looking into decoding and decryption minutia.

M

Tom Andersson

unread,
Dec 30, 2015, 4:45:18 AM12/30/15
to CAS Community
Hi,

Thanks for the tips!

It does indeed seem like a URL encoding or rather decoding issue. The base64 data seems to have been url-encoded fine, the + characters are encoded to %2B. However when the key reaches ClientFlowExecutionRepository, It has been decoded so that the + characters have been replaced by whitespace. It seems to be this way already after it's through 

Tom Andersson

unread,
Dec 30, 2015, 4:48:31 AM12/30/15
to CAS Community
Sorry, reply slipped. So it seems to be decoded twice in some way? %2B -> + and then + -> whitespace. But this seems to happen quite early in the request processing, much before it's handled by spring or cas. What am I doing wrong or is it all just very broken? :)

Thank you!
Tom

Tom Andersson

unread,
Dec 30, 2015, 5:04:40 AM12/30/15
to CAS Community
OK nevermind, it was all about missing URL encoding, aka. user error, as suspected.

Thanks though,
Tom

温鹤鸣

unread,
Dec 31, 2015, 3:10:04 AM12/31/15
to Tom Andersson, CAS Community

Hi, anyone have the solution about using CAS to integrate with OTRS system . thans and happy new year 2016!

 

说明: 说明: 说明: 说明: Description: yx80

广州越秀集团有限公司
Guangzhou Yuexiu Holding Limited
温鹤鸣 Winson Wen
信息中心 Information Center
广州市天河区珠江新城珠江西路5号广州国际金融中心65

65/Fl, Guangzhou International Finance Center, No.5 ZhuJiang Xi Rd,

ZhuJiang New Town, GuangZhou, China

Tel: +86 20 88836888 ext. 60114 | Fax: +86 20 88836668

Mobile: 13728013779
Http://www.yuexiu.com

 

 

发件人: cas-...@apereo.org [mailto:cas-...@apereo.org] 代表 Tom Andersson
发送时间: 20151230 18:05
收件人: CAS Community
主题: Re: [cas-user] WebFlow execution decryption problem

Reply all
Reply to author
Forward
0 new messages