CAS protocol questions

[Marvin Addison]

On Fri, Feb 19, 2016 at 2:49 PM Paul B. Henson <henson at cpp.edu> wrote:

> The proxy callback URL can be any arbitrary server?


Yes.


> I thought it had to be a URL in the namespace of the service?


There's no CAS server implementation I'm aware of that enforces that kind
of constraint.


> So if you are using the default Java CA list you are just trusting nobody
> would be able to convince a CA to issue an unauthorized certificate for
> some.server.com?


I'm concerned about Verisign, for example, credentialing a perfectly
legitimate domain owner in Kerbleckistan that is up to no good. When you
use the default Java trust store, you're saying you trust all the major
commercial CAs to issue certs to any legitimate domain owner on the Web.
After all, that's the job of a commercial CA, to vend as many certs as
possible. That's obviously not what you want in this case.

Hope that helps,
M <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160219/2a9d8a35/attachment.html>