Authentication Failed: The user's credentials have expired. CAS v4.2

Question

I have a problem that I do not know how to solve. I have the CAS v4.2 configured on a tomcat 8 port 8443. The spring-security configuration that I have, it does the redirection to the cas correctly, when I authenticate in the cas, in the logs it is clear that the authentication and the ticket generation have been correct. I have configured so that the ticket has a duration of 2 weeks as indicated in the documentation. I have increased the cas session from 5 to 15 in the web.xml as they indicate in the possible errors that is pressed, but all this has resulted in the same. After authenticating myself, I did not redirect myself to the home of the client application but it displays a message "Authentication Failed: The user's credentials have expired"

I do not know what I may be doing wrong or what may be missing by configuring in cas.properties properties according to version 4.2. I would be grateful if you could tell me what this problem could be in order to continue. Thanks in advance.

JDK8. Spring 4.2.6. CAS v4.2. Tomcat8.

Spring-security.xml

    <security:http entry-point-ref="casEntryPoint" auto-config="true" use-expressions="true">
    <security:csrf disabled="false"/>
    <security:custom-filter position="FIRST" ref="ajaxSessionFilter"/>

    <!-- ACCESO SIN RESTRICCIONES -->
    <security:intercept-url pattern="/static/**" access="permitAll"/>
    <security:intercept-url pattern="/WEB-INF/views/**" access="permitAll"/>

    <security:custom-filter ref="casAuthenticationFilter" after="CAS_FILTER"/>

    <security:intercept-url pattern="/**" access="isAuthenticated()" />
</security:http>


<bean id="casServiceProperties" class="org.springframework.security.cas.ServiceProperties"
    p:service="http://localhost:8080/aap/j_spring_cas_security_check"
    p:sendRenew="false" p:authenticateAllArtifacts="true" />

<bean id="casEntryPoint"
    class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
    p:serviceProperties-ref="casServiceProperties" p:loginUrl="https://cas:8443/cas/login" />

<bean id="ajaxSessionFilter" class="com.xxxx.auth.web.filters.ajax.SessionFilter">  
    <property name="homePage" value="https://cas:8443/cas/login"/>
</bean>

<bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
    <property name="serviceProperties" ref="casServiceProperties"/>
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationFailureHandler">
        <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
            <property name="defaultFailureUrl" value="/casfailed"/>
        </bean>
    </property>
    <!-- -->
    <property name="authenticationSuccessHandler">
        <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
            <property name="defaultTargetUrl" value="/"/>
        </bean>
    </property>

    <property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" />
</bean>

<bean id="proxyGrantingTicketStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />

<bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"/>

<!-- This filter redirects to the CAS Server to signal Single Logout should be performed -->
<bean id="requestSingleLogoutFilter"
    class="org.springframework.security.web.authentication.logout.LogoutFilter"
    p:filterProcessesUrl="/j_spring_cas_security_logout">
    <constructor-arg value="https://cas:8443/cas/logout" />
    <constructor-arg >
        <bean
            class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
    </constructor-arg>
</bean>

<!-- This filter handles a Single Logout Request from the CAS Server -->
<bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider ref="casAuthenticationProvider"/>
</security:authentication-manager>

<bean id="casAuthenticationProvider"
    class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
    <property name="authenticationUserDetailsService">
        <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
            <constructor-arg ref="userDetailService" />
        </bean>
    </property>
    <property name="serviceProperties" ref="casServiceProperties" />
    <property name="ticketValidator">
        <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
            <constructor-arg index="0" value="https://cas:8443/cas" />
            <property name="proxyGrantingTicketStorage" ref="proxyGrantingTicketStorage" />
        </bean>
    </property>
    <property name="key" value="CAS"/>
</bean>

<bean id="userDetailService" class="com.xxx.services.security.userdetails.PSOUserDetailsService"/>

cas.properties

# Decides whether SSO cookie should be created only under secure connections.
 tgc.secure=true

# The expiration value of the SSO cookie
 tgc.maxAge=1209600

# The name of the SSO cookie
 tgc.name=TGC

# The path to which the SSO cookie will be scoped
 tgc.path=/cas

# The expiration value of the SSO cookie for long-term authentications
 tgc.remember.me.maxAge=1209600

# Decides whether SSO Warning cookie should be created only under secure connections.
 warn.cookie.secure=true

# The expiration value of the SSO Warning cookie
 warn.cookie.maxAge=1209600

# The name of the SSO Warning cookie
 warn.cookie.name=CASPRIVACY

# The path to which the SSO Warning cookie will be scoped
 warn.cookie.path=/cas
##
# Single Sign-On Session TGT Timeouts
#
# Inactivity Timeout Policy
 tgt.timeout.maxTimeToLiveInSeconds=1209600

# Default Expiration Policy
 tgt.maxTimeToLiveInSeconds=28800
 tgt.timeToKillInSeconds=7200

##
# Service Ticket Timeout
#
 st.timeToKillInSeconds=28800
 st.numberOfUses=1

 tgc.remember.me.maxAge=1209600

Cookie

"CASPRIVACY=""; 
Expires=Thu, 01-Jan-1970 00:00:10 GMT; 
Path=/cas; 
SecureTGC=eyJhbGciOiJIUzUxMiJ9.WlhsS2FHSkhZMmxQYVVwcllWaEphVXhEU214aWJVMXBUMmxLUWsxVVNUUlJNRXBFVEZWb1ZFMXFWVEpKYmpBdUxqRnNSVEl5T1U5SFdsQTRVWFpUTFc5VWIzRmpNRUV1T0Vac2J6QnRaMjl5ZVRWRk9XRnFNR3AwVFZKcFNIQklTVGt5YjJGelNWZE9XR0pEU2swM2VrMUJRekJYVUVjd1UwSnRaRGRaTTFwVlJHNVROekpNTjA5aWNsZGtjMEo2TkVGVVZYQkJWMGxPVEhKQkxWSmxVWEozZUdWRlpFaGxOV2xEYkhZdFgxUnRWbXBYY0hJeFZEWlpXQzFRVG1kcFdtNUJRa2RuTW5CdlRHOUxaRzB3VFMxQk56ZFNWelZ4YVdORVQxQXRVekEzTVVVNGNFSmxWVFJ2UkZwZmVFTTNWRzVFVlRWRmMyeFJRVXR3Y2tOMFlXMVhTVVJGT0ZoQ00xQlNaV0pMVTJGcVJrMVdPV1ZEVmxkU1ozaEtkeTVQYTJwSFEzTmhWRmxRVkdwSE0xZG5UVnBVZUVKQg.H2P1nCulIj3BtS-wOJr3PtOVGi1hT6y0PDP0MVSQerwv3khVB-lFQe2BdKNElUYzJhURtW-zwyZK3PuBh6p_eQ; 
Expires=Wed, 18-Jan-2017 15:00:18 GMT; 
Path=/cas; 
Secure"

Answer 1

I respond to myself, and in case someone happens to be the same. The problem lies in the PSOUserDetails, which had not overwritten the method for either the credentials did not expire.

Thanks