In our CAS 5 regression tests, it looks like the optional renew
parameter for /validate, /serviceValidate, and /samlValidate is not
failing as expected for SSO.
We're basically doing the following:
1) log in to app1 (we provide user/passwd credentials):
https://cas.example.org/cas/login?service=https://www.example.com/app1
Get back a TGT and ST
ST=ST-43-XLG4yRfjoTEPLM04L4sN-cas
Validate the ST we got for app1
https://cas.example.org/cas/validate?service=https://www.example.com/app1&ticket=ST-43-XLG4yRfjoTEPLM04L4sN-cas
CAS response
yes
<uh_user>
2) log in to app2 via SSO
https://cas.example.org/cas/login?service=https://www.example.com/app2
Get back ST for app2
ST=ST-44-tWcewTl0mgKGH4xy5bQA-cas
Validate the ST for app2 with renew=true, expect it to fail since
we came in via SSO
https://cas.example.org/cas/validate?service=https://www.example.com/app2&ticket=ST-44-tWcewTl0mgKGH4xy5bQA-cas&renew=true
CAS response ***
yes
<uh_user>
Similarly for /serviceValidate
https://cas.example.org/cas/serviceValidate?service=https://www.example.com/app2&ticket=ST-48-n4bC57VoUdHb055Pr0x6-cas&renew=true
CAS response ***
<cas:serviceResponse xmlns:cas=\'http://www.yale.edu/tp/cas\'>
<cas:authenticationSuccess>
<cas:user>uh_user</cas:user>
</cas:authenticationSuccess>
</cas:serviceResponse>
...and /samlValidate
https://cas.example.org/cas/validate?service=https://www.example.com/app2&ticket=ST-56-fAmHfbnltbdJiifZ4YWp-cas&renew=true
CAS response ***
<saml1p:Response ... >
<saml1p:Status>
<saml1p:StatusCode Value="saml1p:Success"/>
</saml1p:Status>
</saml1p:Response>
Unless we're making incorrect assumptions about the use of SSO, it looks
like we're getting success responses even with the renew parameter?
-baron
--
Baron Fujimoto <[email protected]> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/20161006011440.GN10923%40praenomen.mgt.hawaii.edu.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.
