[Ted Fisher]

Thanks for the response Scott.  
I don't think I was clear enough.  Since CAS is handling the SSO session I should see for each Auth at the IDP a redirect to CAS to get a new Service Ticket.  Not that the user would have to authenticate each time; but when the user has an SSO session at CAS then CAS would generate a new Service Ticket for each auth request.  
I'm not seeing the IDP redirect to CAs for the ST.  If I remove my CAS Ticket Granting cookie then my CAS session is over.   Yet, when I do this the IDP still authenticates without even redirecting to CAS for a ST.  It does appear that the IDP is keeping a session.  When I remove the JSESSIONID cookie then on next auth I see the IDP redirect to CAS as expected.

Ted F. Fisher
Information Technology Services
Bowling Green State University

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 06, 2014 3:57 PM
To: Shib Users
Subject: Re: 

On 8/6/14, 3:53 PM, "Ted Fisher" <tffishe at bgsu.edu> wrote:

>But, while the next AuthnRequest does redirect to idp/Authn/RemoteUser, 
>it does not redirect to our CAS server and instead appears to use and 
>existing session. If I delete the JSESSIONID cookie then it does 
>reidrec to our CAs server as it should, which seems to support that the 
>IDP is using and existing session.

No, *CAS* is using an existing session, not the IdP. That's what you should expect, CAS is a SSO system, like Shibboleth is.

> 
>Am I misunderstanding how the previous sessions is supposed to work?

Yes. You're confusing IdP sessions with CAS sessions.

>Is there a way I can force each AuthnRequst to result in contacting the 
>CAS server in order to let it handle the SSO session as we expected?

I'm not sure what you expected, but forcing people to login to CAS every single time would not be the general expectation. I would imagine you might be able to make that happen, but that's a CAS question, not a Shibboleth one. You've delegated authentication, it's no longer up to the IdP in any way.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net