Shibboleth IDP 3 as CAS Server

[Cantor, Scott]

Taking to dev...

On 6/12/15, 7:18 AM, "users on behalf of Marvin Addison" <users-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:
>
>That simply means that the ticket was found in the backing store. There are other actions that follow ticket lookup, and judging by the detail code E_SESSION_EXPIRED, your IdP session could not be found. Are you using a server-side StorageService implementation for the session store? That's required since the CAS ticket validation step is a back-channel request and the default cookie-based store is not suitable in that situation.

I didn't realize the ticket validation depended on the IdP session, I figured the CAS part would need to be server-side but not necessarily the more general part(s). Is that required in some way by the protocol, or could they be decoupled?

As an example, SAML artifacts don't have to be tied to an IdP session, they'll just result in that one assertion being issued, but the next login attempt won't have SSO as an option.

-- Scott