[Cantor, Scott]

On 8/7/14, 10:26 AM, "Ted Fisher" <tffishe at bgsu.edu> wrote:

>Right - the CAS means of maintaining the session uses the Ticket Granting
>cookie; but each auth request to CAS does generate a new Service Ticket.

Each *auth* request, not every application request. The IdP is an
application.

>Since the IDP is another SSO which is using CAS as its auth source then
>it should be that each IDP auth request should generate a new CAS ST.

No, it shouldn't. Unless you turn off the CAS client's use of a local
session, assuming that's possible. Or I guess set the timeout very low.
That session is most likely the container's business, in which case that's
where you need to adjust the timeout.

>  The IDp has no other way of knowing if the CAS SSO session is still
>valid.  That's what I want is for the IDP to check with CAS at each auth
>to see if the CAS SSO session is still active.

Then tell CAS not to maintain a local session, or reduce its timeout. But
that is *not* the normal way of integrating them.

-- Scott