[Cantor, Scott]

On 8/6/14, 3:53 PM, "Ted Fisher" <tffishe at bgsu.edu> wrote:

>But, while the next AuthnRequest does redirect to idp/Authn/RemoteUser,
>it does not redirect to our CAS server and instead appears to use and
>existing session. If I delete the JSESSIONID cookie then it does reidrec
>to our CAs server as it should, which seems to support that the IDP is
>using and existing session.

No, *CAS* is using an existing session, not the IdP. That's what you
should expect, CAS is a SSO system, like Shibboleth is.

> 
>Am I misunderstanding how the previous sessions is supposed to work?

Yes. You're confusing IdP sessions with CAS sessions.

>Is there a way I can force each AuthnRequst to result in contacting the
>CAS server in order to let it handle the SSO session as we expected?

I'm not sure what you expected, but forcing people to login to CAS every
single time would not be the general expectation. I would imagine you
might be able to make that happen, but that's a CAS question, not a
Shibboleth one. You've delegated authentication, it's no longer up to the
IdP in any way.

-- Scott