My recommendation is for a RoleProvider that is backed by the CAS assertion. This is the strategy used by both the Java CAS client and the Spring Security CAS client, so it has a couple sound precedents. I'm not against providing some sort of role-awareness in the CAS principal, but allowing pluggable role providers is a more modular approach in general. It would facilitate use cases where an application wants only CAS authentication with authorization performed elsewhere; for example a application-specific SQL Server database.
M -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
