Hi, I'm just starting with CAS. I've successfully installed it and it's working as described. What I can't quite understand is this:
After I authenticate a user in an app through CAS, I need to create a session within the app. Let's assume php-style session handling though a session cookie. When should I re-validate through CAS again? If the PHP session cookie is set to expire when the browser closes and the user never closes the browser, he will never re-validate with CAS. And I do want the re-validation to happen because let's say the person has been taken out of the group allowed to use the application. On the other hand, I don't want the user to be in the middle of something in the app and a redirect to force him to log into CAS again. What's the best practice to force re-validation? I'm happy to read about it if somebody has the relevant reference to the docs. Thanks much! Sergei -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/.
