We generate a new service ticket for each interaction I believe. In our case the application is not chatty, it just downloads a single file once per rich client session. Keeping track of backend service session cookies in the rich client might be the best way to go for a more interactive rich client, this may well be handled for you by your particular rich client environment.
________________________________ From: Robert Winch [mailto:[email protected]] Sent: Tuesday, 28 July 2009 9:47 a.m. To: [email protected] Subject: Re: [cas-dev] CAS RESTful API - Is including the TGT in the URI safe? Dale, Thanks for your response. Do you generate a new service ticket to communicate with your services every time, allow reuse of tickets, or maintain session information in a different way (i.e. keeping track of session cookies)? Thanks in advance, Rob On Mon, Jul 27, 2009 at 4:39 PM, Dale Ogilvie <[email protected]> wrote: We use the RESTful api for a rich client. There is a similar risk level having the TGT stored in rich client memory as there is in having the TGT stored in an Internet Explorer session cookie. So I think rich clients are a second valid use-case for the RESTful api. ________________________________ From: Robert Winch [mailto:[email protected]] Sent: Tuesday, 28 July 2009 6:14 a.m. To: [email protected] Subject: Re: [cas-dev] CAS RESTful API - Is including the TGT in the URI safe? We are wanting to use it for rich client (desktop) applications authenticating to web services (both soap and REST). The reason for this is we want a consistent method for authenticating to the services for both web applications and rich client applications. We planned on allowing the ST or PT to be resused, as is done in the Spring Security's stateless mode, in order to prevent the CAS server from being overwhelmed. Any suggestions on this would be greatly appreciated. Thanks again, Rob -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
