[Ted Fisher]

Right - the CAS means of maintaining the session uses the Ticket Granting cookie; but each auth request to CAS does generate a new Service Ticket.  The ST is a one time use for auth of a given application.  For applications once they have a session they do not need to go back to CAS.  But every auth request does get a new ST.  
Since the IDP is another SSO which is using CAS as its auth source then it should be that each IDP auth request should generate a new CAS ST.  The IDp has no other way of knowing if the CAS SSO session is still valid.  That's what I want is for the IDP to check with CAS at each auth to see if the CAS SSO session is still active.

Ted F. Fisher
Information Technology Services


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, August 07, 2014 10:13 AM
To: Shib Users
Subject: Re: 

On 8/7/14, 10:01 AM, "Ted Fisher" <tffishe at bgsu.edu> wrote:

>Thanks for the response Scott.
>I don't think I was clear enough.  Since CAS is handling the SSO 
>session I should see for each Auth at the IDP a redirect to CAS to get 
>a new Service Ticket.

I don't agree. I would imagine that CAS, like most SSO systems, has an agent that works with a session in the application or container, because otherwise every access to an application protected with it would require a service ticker, and that's clearly not true.

>I'm not seeing the IDP redirect to CAs for the ST.  If I remove my CAS 
>Ticket Granting cookie then my CAS session is over.

And what server is that cookie set for?

> Yet, when I do this the IDP still authenticates without even 
>redirecting to CAS for a ST.  It does appear that the IDP is keeping a 
>session.  When I remove the JSESSIONID cookie then on next auth I see 
>the IDP redirect to CAS as expected.

That's exactly what I'd expect. The IdP doesn't use the Java session, but I'm sure CAS does. So that alone proves this is CAS doing what it's expected to do, but definitely nothing to do with the IdP's session mechanism.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net