{"action":"created","issue":{"url":"https://api.github.com/repos/apereo/cas/issues/2002","repository_url":"https://api.github.com/repos/apereo/cas","labels_url":"https://api.github.com/repos/apereo/cas/issues/2002/labels{/name}","comments_url":"https://api.github.com/repos/apereo/cas/issues/2002/comments","events_url":"https://api.github.com/repos/apereo/cas/issues/2002/events","html_url":"https://github.com/apereo/cas/issues/2002","id":177885999,"number":2002,"title":"Webflow Redirection not working with LDAP password policy and Google Apps","user":{"login":"petracvv","id":3154784,"avatar_url":"https://avatars.githubusercontent.com/u/3154784?v=3","gravatar_id":"","url":"https://api.github.com/users/petracvv","html_url":"https://github.com/petracvv","followers_url":"https://api.github.com/users/petracvv/followers","following_url":"https://api.github.com/users/petracvv/following{/other_user}","gists_url":"https://api.github.com/users/petracvv/gists{/gist_id}","starred_url":"https://api.github.com/users/petracvv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petracvv/subscriptions","organizations_url":"https://api.github.com/users/petracvv/orgs","repos_url":"https://api.github.com/users/petracvv/repos","events_url":"https://api.github.com/users/petracvv/events{/privacy}","received_events_url":"https://api.github.com/users/petracvv/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/apereo/cas/labels/Bug","name":"Bug","color":"e11d21"},{"url":"https://api.github.com/repos/apereo/cas/labels/Can't%20Reproduce","name":"Can't Reproduce","color":"FF3083"},{"url":"https://api.github.com/repos/apereo/cas/labels/Google%20Apps","name":"Google Apps","color":"1d76db"},{"url":"https://api.github.com/repos/apereo/cas/labels/Minor","name":"Minor","color":"fef2c0"},{"url":"https://api.github.com/repos/apereo/cas/labels/Needs%20Feedback","name":"Needs Feedback","color":"FF3083"},{"url":"https://api.github.com/repos/apereo/cas/labels/Password%20Policy","name":"Password Policy","color":"1d76db"},{"url":"https://api.github.com/repos/apereo/cas/labels/Spring%20Webflow","name":"Spring Webflow","color":"1d76db"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/apereo/cas/milestones/40","html_url":"https://github.com/apereo/cas/milestones/4.2.7","labels_url":"https://api.github.com/repos/apereo/cas/milestones/40/labels","id":1968896,"number":40,"title":"4.2.7","description":"","creator":{"login":"mmoayyed","id":1205228,"avatar_url":"https://avatars.githubusercontent.com/u/1205228?v=3","gravatar_id":"","url":"https://api.github.com/users/mmoayyed","html_url":"https://github.com/mmoayyed","followers_url":"https://api.github.com/users/mmoayyed/followers","following_url":"https://api.github.com/users/mmoayyed/following{/other_user}","gists_url":"https://api.github.com/users/mmoayyed/gists{/gist_id}","starred_url":"https://api.github.com/users/mmoayyed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmoayyed/subscriptions","organizations_url":"https://api.github.com/users/mmoayyed/orgs","repos_url":"https://api.github.com/users/mmoayyed/repos","events_url":"https://api.github.com/users/mmoayyed/events{/privacy}","received_events_url":"https://api.github.com/users/mmoayyed/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":6,"state":"open","created_at":"2016-08-29T06:18:50Z","updated_at":"2016-10-10T21:42:18Z","due_on":"2016-11-04T00:00:00Z","closed_at":null},"comments":10,"created_at":"2016-09-19T20:17:06Z","updated_at":"2016-10-10T21:42:18Z","closed_at":"2016-10-10T21:42:18Z","body":"CAS Version: 4.2.5\r\nContainer: Tomcat 8.0.37\r\n\r\nWe recently did an upgrade from 4.2.0 to 4.2.5 and encountered an unusual issue related to password expiration and Google Apps integration. When someone has a password that expires within our warning limit ( password.policy.warningDays=15 ) and they try to log into our google apps instance, they are presented with the warning screen telling them how many days left they have before expiration. On this screen there is a continue link but when that link is clicked, they are presented with a blank page or a browser error ( ERR_EMPTY_RESPONSE in Google Chrome).\r\n\r\nLooking at the request logs, I am seeing the webflow execution request from the continue button but the application is returning a 400 code instead of the 302. Other applications or services that are using CAS redirect just fine when used with an account within our warning limit.\r\n\r\nExample access log entry:\r\nhttps://gist.github.com/petracvv/cff0715781bc5eb8a4ebc7eba7f0fcb3\r\n\r\nThe authentication does succeed (the ticket is granted to the client) and if you go to the Gmail login for your domain or any other CAS site you will be logged in. The redirection is all that seems to fail.\r\n\r\nSteps to reproduce:\r\n1) Have an LDAP account with a password that expires within the configured warning period\r\n2) Have a Google Apps domain configured to use your CAS server\r\n3) Attempt to log in with the LDAP account to the Google Apps domain using the appropriate username\r\n4) Enter your credentials on the CAS login page after being redirected from the Google login\r\n5) See the password expiration warning page and click the continue link.\r\n6) See a blank page instead of a redirection to the google service you logged in to.\r\n\r\n\r\nI will be pushing an overlay with credentials removed to the cas-issues project shortly\r\n\r\n----------------------------------------------\r\nI have included the following in my report:\r\n\r\n- [x] CAS server version\r\n- [x] Container/environment type/version (Tomcat, Jetty, Java, Linux/Windows, etc)\r\n- [x] Steps to duplicate the problem\r\n- [x] Stacktraces and CAS logs where appropriate.\r\n- [x] Configuration/Overlay pushed to https://github.com/cas-projects/cas-issues/\r\n"},"comment":{"url":"https://api.github.com/repos/apereo/cas/issues/comments/252753960","html_url":"https://github.com/apereo/cas/issues/2002#issuecomment-252753960","issue_url":"https://api.github.com/repos/apereo/cas/issues/2002","id":252753960,"user":{"login":"petracvv","id":3154784,"avatar_url":"https://avatars.githubusercontent.com/u/3154784?v=3","gravatar_id":"","url":"https://api.github.com/users/petracvv","html_url":"https://github.com/petracvv","followers_url":"https://api.github.com/users/petracvv/followers","following_url":"https://api.github.com/users/petracvv/following{/other_user}","gists_url":"https://api.github.com/users/petracvv/gists{/gist_id}","starred_url":"https://api.github.com/users/petracvv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petracvv/subscriptions","organizations_url":"https://api.github.com/users/petracvv/orgs","repos_url":"https://api.github.com/users/petracvv/repos","events_url":"https://api.github.com/users/petracvv/events{/privacy}","received_events_url":"https://api.github.com/users/petracvv/received_events","type":"User","site_admin":false},"created_at":"2016-10-10T21:42:17Z","updated_at":"2016-10-10T21:42:17Z","body":"Gah. I feel a bit stupid now. It was the httpMaxHeaderSize; the default size is 8K and with the giant execution string + CAS cookies it was over the limit. Don't know how I didn't see it, the tomcat logs did mention it now that I look at them again. \r\n\r\nThanks for pointing me in the right direction! "}}
{"actor":{"display_login":"petracvv"}}