IdP3 CAS gateway issues.

[Marvin Addison]

>
> For whatever reason, our CAS clients that are making requests with the
> gateway=true option for anonymous access, which work well with our CAS
> server, are not working with the IdP.
>
There are two situations to consider in gateway mode:

1. You have a valid IdP session
2. You do NOT have a valid IdP session

The CAS protocol [1] says a ticket MAY be returned in the first case;
conversely, the ticket MUST NOT be returned in the second.

My recollection is that I intended to _never_ grant a service ticket when a
client requests gateway mode. That's likely different from what Jasig CAS
does, but it's clearly allowed by the protocol spec.

> The IdP is redirecting back to the service without painting a login view
> as expected, but the redirect does not have any parameters included, namely
> the ticket, if I already have a session on the IdP.
>
I'm open to changing the behavior, but I'd need to understand your use case
better.

M

[1]
https://github.com/Jasig/cas/blob/4.1.x/cas-server-documentation/protocol/CAS-Protocol-Specification.md
(the
2.0 spec is MIA on the Web, but the relevant parts are unchanged in 3.0)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/53cd800c/attachment.html>