The rememberMe Wiki page https://wiki.jasig.org/display/CASUM/Remember+Me
states:
When "Remember Me" is being used, an attribute is added to the Authentication
object.
This attribute is RememberMeCredentials#AUTHENTICATION_ATTRIBUTE_REMEMBER_ME
with a value of Boolean.TRUE.
This is not correct in my opinion. All it does is to indicate when a user
selected the "Remember Me" checkbox.
It does not state anything about if this is a recurring, remembered user login.
Also, an example how the casServiceValidate.jsp page can be extended with this
attribute would be useful:
<cas:attributes>
<cas:isRemembered>${fn:escapeXml(assertion.chainedAuthentications[fn:length(assertion.chainedAuthentications)-1].attributes['org.jasig.cas.authentication.principal.REMEMBER_ME'])}</cas:isRemembered>
</cas:attributes>
It would be great if one can add the following to the rememberMe wiki page:
Notifying Applications if users login is a "remembered" one:
When a user is authenticated with a remembered ticket, an attribute is added to
the Authentication object.
This attribute is Assertion#FROM_NEW_LOGIN with a value of Boolean.TRUE.
You can extend the casServiceValidate response XML fragment to present this
value to your CAS clients, so they can handle this information internally.
Extend the casServiceValidate.jsp page with a new element:
<cas:attributes>
<cas:isFromNewLogin>${fn:escapeXml(assertion.fromNewLogin)}</cas:isFromNewLogin>
</cas:attributes>
Note that this attribute is not defined in the CAS 2.0 specification, yet.
Example use case: Force anteractive CAS relogin if a remembered user tries to
access a special secured page (e.g. users credit card profile page).
Hope it is of any help,
Robert
--
You are currently subscribed to [email protected] as:
[email protected]
To unsubscribe, change settings or access archives, see
http://www.ja-sig.org/wiki/display/JSG/cas-dev
