{"action":"created","issue":{"url":"https://api.github.com/repos/apereo/mod_auth_cas/issues/148","repository_url":"https://api.github.com/repos/apereo/mod_auth_cas","labels_url":"https://api.github.com/repos/apereo/mod_auth_cas/issues/148/labels{/name}","comments_url":"https://api.github.com/repos/apereo/mod_auth_cas/issues/148/comments","events_url":"https://api.github.com/repos/apereo/mod_auth_cas/issues/148/events","html_url":"https://github.com/apereo/mod_auth_cas/issues/148","id":341901575,"node_id":"MDU6SXNzdWUzNDE5MDE1NzU=","number":148,"title":"RequestID is missing in SAML","user":{"login":"fbacchella","id":967097,"node_id":"MDQ6VXNlcjk2NzA5Nw==","avatar_url":"https://avatars2.githubusercontent.com/u/967097?v=4","gravatar_id":"","url":"https://api.github.com/users/fbacchella","html_url":"https://github.com/fbacchella","followers_url":"https://api.github.com/users/fbacchella/followers","following_url":"https://api.github.com/users/fbacchella/following{/other_user}","gists_url":"https://api.github.com/users/fbacchella/gists{/gist_id}","starred_url":"https://api.github.com/users/fbacchella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fbacchella/subscriptions","organizations_url":"https://api.github.com/users/fbacchella/orgs","repos_url":"https://api.github.com/users/fbacchella/repos","events_url":"https://api.github.com/users/fbacchella/events{/privacy}","received_events_url":"https://api.github.com/users/fbacchella/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-07-17T12:39:55Z","updated_at":"2018-07-18T21:07:24Z","closed_at":null,"author_association":"NONE","body":"At https://github.com/apereo/cas/blob/master/support/cas-server-support-saml/src/main/java/org/apereo/cas/support/saml/authentication/principal/SamlServiceFactory.java#L107\r\n\r\nThe attribute RequestID can't be null.\r\nLooking at the saml example from documentation from https://apereo.github.io/cas/5.3.x/protocol/SAML-Protocol.html#sample-request\r\n\r\n    <SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\">\r\n      <SOAP-ENV:Header/>\r\n      <SOAP-ENV:Body>\r\n        <samlp:Request xmlns:samlp=\"urn:oasis:names:tc:SAML:1.0:protocol\" MajorVersion=\"1\"\r\n          MinorVersion=\"1\" RequestID=\"_192.168.16.51.1024506224022\"\r\n          IssueInstant=\"2002-06-19T17:03:44.022Z\">\r\n          <samlp:AssertionArtifact>\r\n            ST-1-u4hrm3td92cLxpCvrjylcas.example.com\r\n          </samlp:AssertionArtifact>\r\n        </samlp:Request>\r\n      </SOAP-ENV:Body>\r\n    </SOAP-ENV:Envelope>\r\n\r\nBut with mod_auth_cas-1.1, the request is:\r\n\r\n```\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\">\r\n    <SOAP-ENV:Header/>\r\n    <SOAP-ENV:Body>\r\n        <samlp:Request xmlns:samlp=\"urn:oasis:names:tc:SAML:1.0:protocol\"  MajorVersion=\"1\" MinorVersion=\"1\">\r\n            <samlp:AssertionArtifact>ST-1-XXXXX</samlp:AssertionArtifact>\r\n        </samlp:Request>\r\n    </SOAP-ENV:Body>\r\n</SOAP-ENV:Envelope>\r\n```\r\n\r\nThe RequestID is missing. And indeed, at https://github.com/apereo/mod_auth_cas/blob/master/src/mod_auth_cas.c#L1827:\r\n\r\n\t\tsamlPayload = apr_psprintf(r->pool, \"<?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\"?><SOAP-ENV:Envelope xmlns:SOAP-ENV=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\"><SOAP-ENV:Header/><SOAP-ENV:Body><samlp:Request xmlns:samlp=\\\"urn:oasis:names:tc:SAML:1.0:protocol\\\"  MajorVersion=\\\"1\\\" MinorVersion=\\\"1\\\"><samlp:AssertionArtifact>%s%s</samlp:AssertionArtifact></samlp:Request></SOAP-ENV:Body></SOAP-ENV:Envelope>\",ticket, getCASRenew(r));\r\n\r\n\r\nNo RequestID. So SAMLv1 is not usable with mod_auth_cas and CAS 5. What can I doing ?"},"comment":{"url":"https://api.github.com/repos/apereo/mod_auth_cas/issues/comments/406074735","html_url":"https://github.com/apereo/mod_auth_cas/issues/148#issuecomment-406074735","issue_url":"https://api.github.com/repos/apereo/mod_auth_cas/issues/148","id":406074735,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNjA3NDczNQ==","user":{"login":"serac","id":111432,"node_id":"MDQ6VXNlcjExMTQzMg==","avatar_url":"https://avatars1.githubusercontent.com/u/111432?v=4","gravatar_id":"","url":"https://api.github.com/users/serac","html_url":"https://github.com/serac","followers_url":"https://api.github.com/users/serac/followers","following_url":"https://api.github.com/users/serac/following{/other_user}","gists_url":"https://api.github.com/users/serac/gists{/gist_id}","starred_url":"https://api.github.com/users/serac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serac/subscriptions","organizations_url":"https://api.github.com/users/serac/orgs","repos_url":"https://api.github.com/users/serac/repos","events_url":"https://api.github.com/users/serac/events{/privacy}","received_events_url":"https://api.github.com/users/serac/received_events","type":"User","site_admin":false},"created_at":"2018-07-18T21:07:24Z","updated_at":"2018-07-18T21:07:24Z","author_association":"NONE","body":"@dhawes _RequestID_ just needs to be unique on a per-request basis. OWASP [1] recommends 16 bytes of entropy in session identifiers, which have similar requirements; the CAS client is consistent with that recommendation.\r\n\r\n[1] https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Session_ID_Length"}}
{"actor":{"display_login":"serac"}}