CAS and method=POST

[Brian Biggs]

Follow up:

I was able to work around this issue, specifically with PeopleSoft, by:

1. Writing a script that builds a form with hidden fields and 
auto-submits it; effectively a POST "redirect" if you will.
2. Adjusting the service name on the PS side to match the script.

So it works like this now:

User logins into portal (authenticating via CAS)
User clicks link to PeopleSoft, which sends them to the new script
New script generates a form that does a POST with appropriately valued 
hidden form fields, and auto-submits
PeopleSoft calls /serviceValidate with a service matching the script
User is now logged into PeopleSoft

This is definitely not ideal, but will work until Marvin and team have 
time to work on adding the POST method to CAS.

It may not be a wide-spread issue, but in our implementation of 
PeopleSoft, if the request doesn't come in as a POST, the service 
validate code doesn't run.

Thanks again,
-Brian

On 02/23/2016 10:20 AM, Brian Biggs wrote:
> Hi,
>
> Opened ticket as requested: 
> https://issues.shibboleth.net/jira/browse/IDP-928
>
> Thanks,
> -Brian
>
> On 02/23/2016 09:53 AM, Marvin Addison wrote:
>> On Tue, Feb 23, 2016 at 12:37 PM Brian Biggs <brian.biggs at sonoma.edu 
>> <mailto:brian.biggs at sonoma.edu>> wrote:
>>
>>     Not that's it's terribly relevant, but the "method=POST" argument
>>     was supported as far back as CAS v3.4.10
>>
>>
>> It's relevant in that it's something that apparently folks need, and 
>> the evolution from a server-specific feature to something that's in 
>> the next protocol revision indicates it's sufficiently important to 
>> merit standardization. In any case I'm open to implementing support 
>> for that parameter.
>>
>> Please file a Jira enhancement issue and I'll look into targeting 
>> 3.3.0. I don't think the protocol document is terribly clear about 
>> how it should work, but I can review Jasig CAS server implementation 
>> to ensure the IdP does the same thing.
>>
>> M
>>
>>
>>
>
> -- 
>
> Brian Biggs
> Sonoma State University
>
>

-- 

Brian Biggs
Sonoma State University

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160225/150d73fd/attachment.html>