Maybe you should try to think if you can route existing AJAX to B via A back again to B but letting the service A resolve calls in behalf of clients of A. You can authenticate calls to B from the A back end, or if B is replicable you could do an additonal private deployment of B not casified but with use restricted to A us using network configuration, routing or whitelisting.
Hope that helped, Sent from my iPhone > On 26 Jan 2017, at 06:33, C. C. Tang <[email protected]> wrote: > > Hi, I have a similar use case that > App-A is an web page that use ajax to call App-B webservice. > How should I protect App-B webservice by CAS? > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/56004070-75ce-4c7b-ae70-550e0c8a8e20%40apereo.org. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/6581D7E9-9267-424A-8016-450B1FEBBE9A%40madiva.com.
