There are probably a bunch of other problems associated with this idea, but 
couldn't you just serve the CAS service from 2 distinct domains?  E.g. 
cas.example.net and cas.special.example.net?  Since the TGT is scoped to a 
particular domain, if you point A's CAS client to the special domain, it should 
act like its own unique CAS instance.

Thanks,
Carl Waldbieser
ITS Identity Management
Lafayette College

----- Original Message -----
From: "Andy Ng" <[email protected]>
To: "cas-user" <[email protected]>
Sent: Wednesday, April 25, 2018 5:20:01 AM
Subject: [cas-user] [SSO] Is it possible to make a service completely separated 
from other SSO services without require login every time (i.e. renew=true)

Hi all,

So I have done some research on this group and still doesn't find other 
with my use case, so I am asking for your help.

Assume we have services A, B, C and D:

B, C, D are normal SSO services, each one of them authenticate success, all 
BCD will login success.

As for A, I want that even when BCD is authenticated, user still needs to 
authenticate once more before getting to A.

At this point, theoretically all can be solved by* "renew=true"*. And the 
new *createSsoCookieOnRenewAuthn = false on 5.3.0*
 
(https://github.com/apereo/cas/blob/v5.3.0-RC3/api/cas-server-core-api-configuration-model/src/main/java/org/apereo/cas/configuration/model/core/sso/SsoProperties.java)

However, the tricky part is that, next time when user go back to service A , 
I want the user to *no need to authenticate again*.

So it is basically like Service A is using another completely separated CAS 
server. Without actually using a separated CAS server (I don't want to make 
another server just for this).

One more requirement would be to single logout all ABCD, but I know how to 
do that so no advice is needed there.


Any advice would be appreciated, Thanks!

-Andy


-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/f1002b09-eb19-477d-a733-13a6d45bad26%40apereo.org.

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/1827159704.70324385.1524750195544.JavaMail.zimbra%40lafayette.edu.

Reply via email to