CAS验证SAML错误

Question

I am using CAS authentication in one of my applications. CAS version jar is - cas-client-core-3.1.10.jar. While using my correct credentials it gives me the following exception -

org.jasig.cas.client.validation.TicketValidationException: No valid assertions from the SAML response found.
org.jasig.cas.client.validation.TicketValidationException: No valid assertions from the SAML response found.
at org.jasig.cas.client.validation.Saml11TicketValidator.parseResponseFromServer(Saml11TicketValidator.java:97)
at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:188)

Wondering what is the reason for this exception? While checking for the source of the Saml11TicketValidator.java I did not see the exact scenario in which this error message comes. Any idea what this message indicates?

Answer 1

I got the solution to this problem. The actual problem was with the clock speed on my system. My system's current timestamp didn't fall between the BEFORE & AFTER timestamps from CAS. And the value of configurable parameter - 'tolerance' (provided by CAS) did not help either. So I configured tolerance parameter to a HUGE long value (ie 75000). By this I was able to bypass the TicketValidationException thrown by CAS.

Answer 2

To clarify munna's response, I had the same issue and resolved it by adding the tolerance parameter to the web.xml in the application that uses the CAS Client:

<init-param>
    <!--
        Adjust to accommodate clock drift between client/server.
        Increasing tolerance has security consequences, so it is
        preferable to correct the source of clock drift instead.
    -->
    <param-name>tolerance</param-name>
    <param-value>5000</param-value>
</init-param>

For a complete example of the Saml11TicketValidationFilter see, https://wiki.jasig.org/display/CASC/Saml11TicketValidationFilter+Example .

Answer 3

yes actually i have also same error...it was problem because of cas server time was diffent.

now issue resolved by setting timestamp