What you described is good, and it's how work my app and examples provided.
After requesting on each request a CAS ACCESS TOKEN isn't needed, but at
least on your REST server managing a token is needed or you need to
manage a session cookie (or a map token/session), so the jwt token is a
way to secure your app, even in my mind it's better than a cookie.
Le 10/07/2017 à 15:15, Filip Majernik a écrit :
First of all, thank you all for the responses, it helps me very much.
I will take a look on that example with Angular.
However, I think I've found a solution (or at least going to try that
way). I will go away from the OpenID or OAuth (imho I don't really
think that they are well suited for what I need. Almost all the
examples in spring are using the same app for the resource server as
for the oauth server). I have reviewed the CAS protocol and I am going
to try to implement it in this way:
1.) The angluarJS will redirect to the login page.
2.) After successful login the user is redirected to the angular app
again but with a SERVICE TICKET
3.) When the first call is made to the REST API, the SERVICE TICKET
would be validated and if valid, then it creates a session cookie.
4.) All the other REST API calls would get authorized unless the
session cookie expires (without validating the SERVICE TICKET again).
Somehow I got fixed on the word "stateless", because the REST API is
stateless. But if I really would like to be stateless, this would
indeed require to contact the CAS server every time with an ACCESS
TOKEN and validate if it.
So feel free to correct me if I am wrong, but I think the above
described solution with the CAS protocol is fine.
On Monday, July 10, 2017 at 2:33:56 PM UTC+2, Julien Gribonvald wrote:
Hi Filip,
Did you watch on what is possible with spring security ? there are
several possibilities to secure your REST API, and in my mind jwt
is a
good option.
I developped an angular app and used spring-security, I didn't
used the
jwp protocol as it was not well documented when I developped my
app but
I think I would you use it now.
My app can be found here :
https://github.com/EsupPortail/esup-publisher
<https://github.com/EsupPortail/esup-publisher>
Or if you prefer you can find a POC of the auth mecanism here :
https://github.com/jgribonvald/demo-spring-cas-angular
<https://github.com/jgribonvald/demo-spring-cas-angular> or
someone made a
documented and more advanced example here :
https://github.com/rohajda/casdemo
<https://github.com/rohajda/casdemo> (he used my POC).
For jwt example you can rely on Pascal's explanations, or maybe on
web
you can find easily somes well explaned documentations (search on
"spring security jwt").
Thanks
Julien
Le 10/07/2017 à 13:35, Pascal Rigaux a écrit :
> Hi,
>
> With CAS protocol, your API MUST create its own token/session:
> CAS ticket is a one time token, no way to rely on it.
>
> Another solution is to use OpenID Connect, it should work with
CAS >=
> 5.1 :
> - enable OpenID Connect
> - use implicit flow to obtain CAS generated JWT
> - send JWT to your API
> - REST API checks JWT signature against jwks_uri
>
> Example : https://area51.univ-paris1.fr/prigaux/test-oidc.html
<https://area51.univ-paris1.fr/prigaux/test-oidc.html> (you
> must logged on google first)
>
> Drawbacks:
> - no easy single logout (major pb for us)
>
> French presentation on this:
https://prigaux.frama.io/JwtProxyService/
<https://prigaux.frama.io/JwtProxyService/>
>
> cu
>
>
> Filip Majernik <[email protected] <javascript:>> a écrit :
>
>> Hi Pascal,
>> the reason why I need this is, that the REST API calls can also be
>> performed only by an authorized user. This means that the
AngularJS app
>> must send some token alongside with the request to my REST API and
>> the REST
>> API must be able to validate that token.
>>
>> So the main problem for me is not to login (this can be done
with a
>> redirect, or with posting the username/password, I do not really
>> mind), but
>> to validate the token in my REST API. Because I do not want to
create
>> another http request to the CAS server everytime the Angular
app makes a
>> request.
>>
>> Bye,
>> Filip
>>
>> On Saturday, July 8, 2017 at 6:39:57 PM UTC+2, Pascal Rigaux
wrote:
>>>
>>> Hi,
>>>
>>> Do you really need the handle username/password? Most CAS
applications
>>> avoid this since it breaks SSO.
>>>
>>> A simple solution for AngularJS application is to do as many
other
>>> apps: require a valid session an all html pages [*]
>>>
>>> Example : https://github.com/fedon/spring-cas-auth
<https://github.com/fedon/spring-cas-auth> .
>>>
>>> SPA allows relogging without loosing "browser" activity (eg:
textarea
>>> content). Here is a tutorial application with phpCAS that shows
>>> various ways to handle CAS relog in a SPA :
>>> https://github.com/prigaux/angular-seed
<https://github.com/prigaux/angular-seed>
>>>
>>> * forked from "angular-seed" (an old version)
>>> added some php pages
>>> kept index.html, but the app really is index.php
>>>
>>> * every commits shows a different functionality. To understand
them,
>>> start from the first one, then have a look at the more advanced
>>> features:
>>> - CAS example : minimal casification
>>> - CAS example using http-auth-interceptor : same but using a
module
>>> intercepting every $http calls
>>> - use ngRoute "resolve" : avoid displaying page "view1" until
the user
>>> is authenticated
>>> - replace alert with modal window from angular UI Bootstrap :
prepares
>>> the next commit
>>> - add transparent relog using jsonp + CAS gateway : if app
session is
>>> expired, try transparent login on CAS using JSONP
>>> - add relog using window.open+postMessage : if transparent relog
>>> failed, instead of restarting application, use
window.open+postMessage
>>>
>>> * to make it work:
>>>
>>> git clone --depth 4
https://github.com/prigaux/angular-seed.git
<https://github.com/prigaux/angular-seed.git>
>>> angular-seed-phpCAS
>>> cd angular-seed-phpCAS
>>> bower install
>>>
>>> You need phpCAS :
>>> https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
<https://wiki.jasig.org/display/CASC/phpCAS+installation+guide>
>>>
>>> Happy CAS,
>>> cu
>>>
>>>
>>> [*] if your first page is static AND CAS protected, you must
ensure it
>>> is not browser cached
>>>
>
>
--
Julien Gribonvald
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e9d7158-f094-ade1-8bb5-939afb82966d%40recia.fr.
