Hi Sergei! And welcome to CAS. :) Ah the wonderful world of session management in a WebSSO environment...
If you need authorization changes to take effect within the window of an active application session you'll most likely need to account for that in the application and independent of CAS. For Java apps Shiro has support for realtime authZ changes like you've described....not sure about PHP land. If you are doing coarse-grained authZ with CAS (i.e. restricting ST issuance based on some user attributes) and you'd like the changes to take effect within an SSO session (and outside an application session), you'll like need to customize the CAS server as those attributes are also usually cached for the length of the SSO session. Best, Bill On Fri, Dec 4, 2015 at 10:43 AM, Sergei Gerasenko <[email protected]> wrote: > Hi, > > I'm just starting with CAS. I've successfully installed it and it's > working as described. What I can't quite understand is this: > > After I authenticate a user in an app through CAS, I need to create a > session within the app. Let's assume php-style session handling though a > session cookie. When should I re-validate through CAS again? If the PHP > session cookie is set to expire when the browser closes and the user never > closes the browser, he will never re-validate with CAS. And I do want the > re-validation to happen because let's say the person has been taken out of > the group allowed to use the application. On the other hand, I don't want > the user to be in the middle of something in the app and a redirect to > force him to log into CAS again. > > What's the best practice to force re-validation? I'm happy to read about > it if somebody has the relevant reference to the docs. > > > Thanks much! > Sergei > -- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/. > -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/.
