Hi, We haven't seen any of these issues with mod_auth_cas. I believe the only time you would see them is if you protect the images and css, but not the page that references them.
If you protect the page as well, then when someone accesses the page they get redirected to your cas server. After they authenticate, mod_auth_cas remembers their credentials, so they do not get redirected to the cas server when they request the images and css. Therefore, everything works correctly. You only have a problem if the page isn't protected, but the images and css are, or, I suppose, in the comparatively rare case where the browser has cached the page, but not the images or css. In these cases, you get redirected to the cas server when you request an image or css file, and this may confuse browsers. One place where mod_auth_cas can cause problems is with audio and video files. This is an issue for people using IE and Windows Media Player. First, login to a web site with cas. Then, when you try to access a media file, IE passes the URL to Windows Media Player. You've already authenticated with IE, but Windows Media Player doesn't have access to that session, so when it tries to get a media file, the web server redirects it to the cas server to authenticate, and Windows Media Player can't handle the cas redirect. Earl Fogel Information Technology Services University of Saskatchewan -- On Mon, 23 Feb 2009, Thung, Peter C CIV SPAWAR SSC PAC, 56340 wrote: >In regards to the following: >mod_auth_cas >http://www.ja-sig.org/wiki/display/CASC/mod_auth_cas > >mod_cas >http://www.ja-sig.org/wiki/display/CASC/MOD_CAS > >After reading the description of the two I came across this in regards to teh >mod_cas client. >When not to use MOD_CAS >(Per Scott Lundgren's email). > >mod_cas not should not be used with pages that use frames >directories of images files should be moved out from under mod_cas protection >because browsers (IE 6 & Firefox 1.06) do not know how to handle the redirects >for the requests for images embedded in an HTML page >directories of CSS files should be moved out from under mod_cas protection for >the same reasons >mod_cas cannot be used with server generated images where scripts return an >image stream > >In our particular website, it does use frames and does have embedded images in >HTML pages. >Apparently it does not have any issues using regular Basic Authentication using >the built in mod_auth directive. > >Does anyone know if any of these mod_cas issues were addressed in the >mod_auth_cas implementation? > >Anyone have any idea if it is even possible to address this issues given the >CAS architecture and hence why there was a cautionary note on MOD_CAS? > >Thanks. > >-Peter > > >****************************************************************** > >Peter Thung > >SPAWAR Systems Center PACIFIC (Code 56340) > >Netcentric ISR Development > >Software Developer > >Primary: (619) 553-6513 > >Secondary:(619) 553-0777 > >****************************************************************** > > > > > > -- >You are currently subscribed to [email protected] as: [email protected] >To unsubscribe, change settings or access archives, see >http://www.ja-sig.org/wiki/display/JSG/cas-dev > > -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
