{"action":"created","issue":{"url":"https://api.github.com/repos/Jasig/phpCAS/issues/181","labels_url":"https://api.github.com/repos/Jasig/phpCAS/issues/181/labels{/name}","comments_url":"https://api.github.com/repos/Jasig/phpCAS/issues/181/comments","events_url":"https://api.github.com/repos/Jasig/phpCAS/issues/181/events","html_url":"https://github.com/Jasig/phpCAS/issues/181","id":120168486,"number":181,"title":"setFixedServiceURL() prevents getURL() from removing the QS parameters","user":{"login":"jbousquie","id":11529,"avatar_url":"https://avatars.githubusercontent.com/u/11529?v=3","gravatar_id":"","url":"https://api.github.com/users/jbousquie","html_url":"https://github.com/jbousquie","followers_url":"https://api.github.com/users/jbousquie/followers","following_url":"https://api.github.com/users/jbousquie/following{/other_user}","gists_url":"https://api.github.com/users/jbousquie/gists{/gist_id}","starred_url":"https://api.github.com/users/jbousquie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbousquie/subscriptions","organizations_url":"https://api.github.com/users/jbousquie/orgs","repos_url":"https://api.github.com/users/jbousquie/repos","events_url":"https://api.github.com/users/jbousquie/events{/privacy}","received_events_url":"https://api.github.com/users/jbousquie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Jasig/phpCAS/labels/Minor%20Bug","name":"Minor Bug","color":"d7e102"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/Jasig/phpCAS/milestones/8","html_url":"https://github.com/Jasig/phpCAS/milestones/1.3.5","labels_url":"https://api.github.com/repos/Jasig/phpCAS/milestones/8/labels","id":1412178,"number":8,"title":"1.3.5","description":"","creator":{"login":"jfritschi","id":1036402,"avatar_url":"https://avatars.githubusercontent.com/u/1036402?v=3","gravatar_id":"","url":"https://api.github.com/users/jfritschi","html_url":"https://github.com/jfritschi","followers_url":"https://api.github.com/users/jfritschi/followers","following_url":"https://api.github.com/users/jfritschi/following{/other_user}","gists_url":"https://api.github.com/users/jfritschi/gists{/gist_id}","starred_url":"https://api.github.com/users/jfritschi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfritschi/subscriptions","organizations_url":"https://api.github.com/users/jfritschi/orgs","repos_url":"https://api.github.com/users/jfritschi/repos","events_url":"https://api.github.com/users/jfritschi/events{/privacy}","received_events_url":"https://api.github.com/users/jfritschi/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":1,"state":"open","created_at":"2015-11-15T12:39:30Z","updated_at":"2015-12-05T10:42:21Z","due_on":"2016-12-30T23:00:00Z","closed_at":null},"comments":3,"created_at":"2015-12-03T13:15:04Z","updated_at":"2015-12-05T12:42:22Z","closed_at":null,"body":"My CAS client webapp (_redirect.php_) is behind a reverse proxy. \r\nIts public URL is different from its internal one. Moreover, the public URL is under **https** but its internal is under **http**.\r\n\r\nIn brief, `getURL()` can't guess the right public URL to validate the ST, so I set the client webapp public URL with `phpCAS::setFixedURL($public_URL_value)`.\r\n\r\nSince the **requested** public URL has some parameters in its query string, it is slightly different from the fixed URL set.\r\nExample : \r\nrequested : `https://ego.iut-rodez.fr/caslogger/redirect.php?_cLt=eughvlgv`\r\nfixed : `https://ego.iut-rodez.fr/caslogger/redirect.php`\r\n\r\nIt seems that, if a fixed URL is set, `getURL()` doesn't remove the query string what then prevents the ST to be validated.\r\n\r\nLog example : \r\n\r\n```\r\n1CD0 .=> phpCAS::setFixedServiceURL('https://ego.iut-rodez.fr/caslogger/redirect.php') [redirect.php:30]\r\n1CD0 .<= ''\r\n1CD0 .=> phpCAS::setNoCasServerValidation() [redirect.php:31]\r\n1CD0 .|    You have configured no validation of the legitimacy of the cas server. This is not recommended for production use. [CAS.php:1669]\r\n1CD0 .<= ''\r\n1CD0 .=> phpCAS::checkAuthentication() [redirect.php:32]\r\n1CD0 .|    => CAS_Client::checkAuthentication() [CAS.php:1078]\r\n1CD0 .|    |    => CAS_Client::isAuthenticated() [Client.php:1131]\r\n1CD0 .|    |    |    => CAS_Client::_wasPreviouslyAuthenticated() [Client.php:1189]\r\n1CD0 .|    |    |    |    no user found [Client.php:1375]\r\n1CD0 .|    |    |    <= false\r\n1CD0 .|    |    |    CAS 2.0 ticket `ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz' is present [Client.php:1223]\r\n1CD0 .|    |    |    => CAS_Client::validateCAS20('', NULL, NULL) [Client.php:1224]\r\n1CD0 .|    |    |    |     [Client.php:2747]\r\n1CD0 .|    |    |    |    => CAS_Client::getServerServiceValidateURL() [Client.php:2753]\r\n1CD0 .|    |    |    |    |    => CAS_Client::getURL() [Client.php:417]\r\n1CD0 .|    |    |    |    |    <= 'https://ego.iut-rodez.fr/caslogger/redirect.php'\r\n1CD0 .|    |    |    |    <= 'https://cas2.iut-rodez.fr/cas/serviceValidate?service=https%3A%2F%2Fego.iut-rodez.fr%2Fcaslogger%2Fredirect.php'\r\n1CD0 .|    |    |    |    => CAS_Client::_readURL('https://cas2.iut-rodez.fr/cas/serviceValidate?service=https%3A%2F%2Fego.iut-rodez.fr%2Fcaslogger%2Fredirect.php&ticket=ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz', NULL, NULL, NULL) [Client.php:2762]\r\n1CD0 .|    |    |    |    |    => CAS_Request_CurlRequest::sendRequest() [AbstractRequest.php:220]\r\n1CD0 .|    |    |    |    |    |    Response Body: \r\n1CD0 .|    |    |    |    |    |    <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>\r\n1CD0 .|    |    |    |    |    |    \t<cas:authenticationFailure code='INVALID_SERVICE'>\r\n1CD0 .|    |    |    |    |    |    \t\tticket &#039;ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz&#039; does not match supplied service.  The original service was &#039;https://ego.iut-rodez.fr/caslogger/redirect.php?_cLt=7HHmTeinEw&amp;_cLs=http://www.iut-rodez.fr/&#039; and the supplied service was &#039;https://ego.iut-rodez.fr/caslogger/redirect.php&#039;.\r\n1CD0 .|    |    |    |    |    |    \t</cas:authenticationFailure>\r\n1CD0 .|    |    |    |    |    |    </cas:serviceResponse>\r\n1CD0 .|    |    |    |    |    |     [CurlRequest.php:82]\r\n1CD0 .|    |    |    |    |    <= true\r\n1CD0 .|    |    |    |    <= true\r\n1CD0 .|    |    |    |    => CAS_AuthenticationException::__construct(CAS_Client, 'Ticket not validated', 'https://cas2.iut-rodez.fr/cas/serviceValidate?service=https%3A%2F%2Fego.iut-rodez.fr%2Fcaslogger%2Fredirect.php&ticket=ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz', false, false, '<cas:serviceResponse xmlns:cas=\\'http://www.yale.edu/tp/cas\\'>\t<cas:authenticationFailure code=\\'INVALID_SERVICE\\'>\t\tticket &#039;ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz&#039; does not match supplied service.  The original service was &#039;https://ego.iut-rodez.fr/caslogger/redirect.php?_cLt=7HHmTeinEw&amp;_cLs=http://www.iut-rodez.fr/&#039; and the supplied service was &#039;https://ego.iut-rodez.fr/caslogger/redirect.php&#039;.\t</cas:authenticationFailure></cas:serviceResponse>', 'INVALID_SERVICE', 'ticket \\'ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz\\' does not match supplied service.  The original service was \\'https://ego.iut-rodez.fr/caslogger/redirect.php?_cLt=7HHmTeinEw&_cLs=http://www.iut-rodez.fr/\\' and the supplied service was \\'https://ego.iut-rodez.fr/caslogger/redirect.php\\'.') [Client.php:2845]\r\n1CD0 .|    |    |    |    |    => CAS_Client::getURL() [AuthenticationException.php:76]\r\n1CD0 .|    |    |    |    |    <= 'https://ego.iut-rodez.fr/caslogger/redirect.php'\r\n1CD0 .|    |    |    |    |    CAS URL: https://cas2.iut-rodez.fr/cas/serviceValidate?service=https%3A%2F%2Fego.iut-rodez.fr%2Fcaslogger%2Fredirect.php&ticket=ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz [AuthenticationException.php:79]\r\n1CD0 .|    |    |    |    |    Authentication failure: Ticket not validated [AuthenticationException.php:80]\r\n1CD0 .|    |    |    |    |    Reason: [INVALID_SERVICE] CAS error: ticket 'ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz' does not match supplied service.  The original service was 'https://ego.iut-rodez.fr/caslogger/redirect.php?_cLt=7HHmTeinEw&_cLs=http://www.iut-rodez.fr/' and the supplied service was 'https://ego.iut-rodez.fr/caslogger/redirect.php'. [AuthenticationException.php:95]\r\n1CD0 .|    |    |    |    |    CAS response: <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>\r\n1CD0 .|    |    |    |    |    \t<cas:authenticationFailure code='INVALID_SERVICE'>\r\n1CD0 .|    |    |    |    |    \t\tticket &#039;ST-834-9kAtXDWynCHPT4T5xItP-cas2.iut.rdz&#039; does not match supplied service.  The original service was &#039;https://ego.iut-rodez.fr/caslogger/redirect.php?_cLt=7HHmTeinEw&amp;_cLs=http://www.iut-rodez.fr/&#039; and the supplied service was &#039;https://ego.iut-rodez.fr/caslogger/redirect.php&#039;.\r\n1CD0 .|    |    |    |    |    \t</cas:authenticationFailure>\r\n1CD0 .|    |    |    |    |    </cas:serviceResponse> [AuthenticationException.php:100]\r\n1CD0 .|    |    |    |    |    exit()\r\n1CD0 .|    |    |    |    |    -\r\n1CD0 .|    |    |    |    -\r\n1CD0 .|    |    |    -\r\n1CD0 .|    |    -\r\n1CD0 .|    -\r\n\r\n\r\n```\r\n\r\nSame problem with phpCAS1.3.2 and 1.3.4, didn't test with 1.3.3"},"comment":{"url":"https://api.github.com/repos/Jasig/phpCAS/issues/comments/162178617","html_url":"https://github.com/Jasig/phpCAS/issues/181#issuecomment-162178617","issue_url":"https://api.github.com/repos/Jasig/phpCAS/issues/181","id":162178617,"user":{"login":"jfritschi","id":1036402,"avatar_url":"https://avatars.githubusercontent.com/u/1036402?v=3","gravatar_id":"","url":"https://api.github.com/users/jfritschi","html_url":"https://github.com/jfritschi","followers_url":"https://api.github.com/users/jfritschi/followers","following_url":"https://api.github.com/users/jfritschi/following{/other_user}","gists_url":"https://api.github.com/users/jfritschi/gists{/gist_id}","starred_url":"https://api.github.com/users/jfritschi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfritschi/subscriptions","organizations_url":"https://api.github.com/users/jfritschi/orgs","repos_url":"https://api.github.com/users/jfritschi/repos","events_url":"https://api.github.com/users/jfritschi/events{/privacy}","received_events_url":"https://api.github.com/users/jfritschi/received_events","type":"User","site_admin":false},"created_at":"2015-12-05T12:42:22Z","updated_at":"2015-12-05T12:42:22Z","body":"Thanks for the details. With this info I can whip up a patch ;-)\r\n\r\nA lot of people struggle because default proxy configs don't set the https protocol info or the loadbalancer use some vendor specific flags. (see othe bug for details: https://github.com/Jasig/phpCAS/issues/178) If all this is properly set up one should not need any fixed urls unless you have a very strange use case. At least this is the goal of the current code ;-)\r\n\r\n"}}