[Cantor, Scott]

On 8/7/14, 10:01 AM, "Ted Fisher" <tffishe at bgsu.edu> wrote:

>Thanks for the response Scott.
>I don't think I was clear enough.  Since CAS is handling the SSO session
>I should see for each Auth at the IDP a redirect to CAS to get a new
>Service Ticket.

I don't agree. I would imagine that CAS, like most SSO systems, has an
agent that works with a session in the application or container, because
otherwise every access to an application protected with it would require a
service ticker, and that's clearly not true.

>I'm not seeing the IDP redirect to CAs for the ST.  If I remove my CAS
>Ticket Granting cookie then my CAS session is over.

And what server is that cookie set for?

> Yet, when I do this the IDP still authenticates without even redirecting
>to CAS for a ST.  It does appear that the IDP is keeping a session.  When
>I remove the JSESSIONID cookie then on next auth I see the IDP redirect
>to CAS as expected.

That's exactly what I'd expect. The IdP doesn't use the Java session, but
I'm sure CAS does. So that alone proves this is CAS doing what it's
expected to do, but definitely nothing to do with the IdP's session
mechanism.

-- Scott