Hi Ray, Thank you for your response!
In the document [ https://apereo.github.io/cas/5.2.x/installation/Configuring-Service-Access-Strategy.html <https://www.google.com/url?q=https%3A%2F%2Fapereo.github.io%2Fcas%2F5.2.x%2Finstallation%2FConfiguring-Service-Access-Strategy.html&sa=D&sntz=1&usg=AFQjCNHGjCe01208SZh5LYP__8QmMeWcig>] for ssoEnabled, pretty sure it is just "renew=true". Which is what I describe above (Service A needs to be login the next time it arrive CAS), not suitable in my case. However I do think if ssoEnabled is recommended, at least I should tried it in an actual CAS server instead of only theorizing. To see if it is what I want or not. Also yes I have read about SSO Session Cookie, also read some CAS source code regarding SSO too (although not line by line). Thanks you for helping me again. - Andy On Thursday, 26 April 2018 01:03:38 UTC+8, rbon wrote: > > Andy, > > Looks like you have already seen > https://apereo.github.io/cas/5.2.x/installation/Configuring-SSO-Session-Cookie.html > . > There is also ssoEnabled, > https://apereo.github.io/cas/5.2.x/installation/Configuring-Service-Access-Strategy.html > .. > > Ray > > On Wed, 2018-04-25 at 02:20 -0700, Andy Ng wrote: > > Hi all, > > So I have done some research on this group and still doesn't find other > with my use case, so I am asking for your help. > > Assume we have services A, B, C and D: > > B, C, D are normal SSO services, each one of them authenticate success, > all BCD will login success. > > As for A, I want that even when BCD is authenticated, user still needs to > authenticate once more before getting to A. > > At this point, theoretically all can be solved by* "renew=true"*. And the > new *createSsoCookieOnRenewAuthn = false on 5.3.0* ( > https://github.com/apereo/cas/blob/v5.3.0-RC3/api/cas-server-core-api-configuration-model/src/main/java/org/apereo/cas/configuration/model/core/sso/SsoProperties.java > ) > > However, the tricky part is that, next time when user go back to service A > , I want the user to *no need to authenticate again*. > > So it is basically like Service A is using another completely separated > CAS server. Without actually using a separated CAS server (I don't want to > make another server just for this). > > One more requirement would be to single logout all ABCD, but I know how to > do that so no advice is needed there. > > > Any advice would be appreciated, Thanks! > > -Andy > > > -- > Ray Bon > Programmer analyst > Development Services, University Systems > 2507218831 | CLE 019 | [email protected] <javascript:> > > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/e4e8efc5-289b-4f1e-ab0f-dac399d7ec8a%40apereo.org.
