Disable SSO session

[Michael A Grady]

> 
>> 
>>> There is no redirection back through CAS in this case.  I notice that the
>>> conversation variable incremented on the second attempt from "e1s1" to
>>> "e2s1".
>> 
>> CAS is a SSO system. The client would be expected to cache and remember a session.
> 
> Yep, you're right!  Apparently, I went through all of this before with IDP v2.4 but forgot about it:
> 
>  https://www.mail-archive.com/cas-user@lists.jasig.org/msg13105.html
> 
> I assumed I had v2.4 configured to delegate to CAS, but I guess not!  So at least there is no change when I upgraded to v3.2.  :)
> 
> I haven't figured out any way to configure the CAS client session yet.
> 

Unicon's Shib-CAS-Authenticator incorporate's a CAS client with client sessions being disabled.

   https://github.com/unicon/shib-cas-authn3

So you could switch to that alternative rather than using the RemoteUser approach. Otherwise, the Apereo Java CAS client:

   https://github.com/Jasig/java-cas-client/blob/e99aaac160e4a4cff1c6097824e9037098f76228/README.md

does appear to have a property to disable a session (useSession, for each ticket validation filter choice), but how/where you can easily set that when you incorporate the CAS client into the IdP I'm not sure.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160107/b4c857d3/attachment.sig>