I have a following architecture: 1.) CAS 5.1 authentication server 2.) Angular JS single page client which is accessing a REST API for the data 3.) Spring REST API
I need to secure the REST API calls from the angular JS client. I.e. only authenticated users should be able to communicate with the REST API through the angular JS application. At the beginning, I thought I could solve this with an OAuth server support in CAS, but this would mean that every call to the REST API would require to check the access token against CAS if it is still valid. According to the documentation it should be possible to do this with proxy tickets. Is my assumption here correct? So it would work like this: 1.) The Angular JS application requests a PROXY GRANTING TICKET by providing the username/password to the CAS 2.) Then it calls any REST API method with this PGT 3.) The spring security in the REST API would request a proxy ticket with this PGT. 4.) All the subsequent calls to the REST API would be done with the PROXY TICKET and the REST API would not need to check the ticket validity against the CAS again. The only thing I do not understand here (coming from this http://docs.spring.io/spring-security/site/docs/3.1.6.RELEASE/reference/cas.html#cas-pt-client) is, that it requires to set the proxyReceptorUrl . Does this mean that the proxy ticket cannot be obtained in some synchronous way, but rather it is sent to that URL? Thanks. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/64bc9900-7305-4769-9f31-f4e1303b5ef8%40apereo.org.
