Hi,

If I understand your requirements correctly, the clients (Web browsers) will never access the Web Services directly.  The browsers will authenticate to CAS and present the Service Ticket to a Web application.  It's that Web application that will need to authenticate, on behalf of the user (a.k.a. client or Web browser), to the Web service.

In my opinion, you should look at using Proxy authentication.  It's designed specifically for applications authenticating on behalf users.  In such scenario your Web application would receive a Proxy Granting Ticket (PGT) when validating its Service Ticket and use that PGT to request Proxy Tickets to present to the Web Services.  Your XFire Web Services would then validate those Procy Tickets directly with CAS.  This should eliminate the need to pass username/password more than once, which is why you are implementing SSO.

Adam

tedzo wrote:
Robert,
Thanks for your response.
I looked at the code you referred to. Co-incidently, we do pretty much exactly what the code you shared does. Unfortunately, thats kind of not what I was looking for. Perhaps I should explain better-
1. I have a webapp that is currently secured using CAS SSO.
2. There are certain services that are currently part of the webapp that are used within the webapp.
3. The goal is to expose those services as web services so that they may be used by external entities.
4. We use XFire to expose the service as a web service.
5. I also want to somehow use CAS to authenticate the web service call AND also get CAS to respect the SSO session between multiple web service calls (basically, I want to pass user name/password to a web service call the first time and be able to do multiple web service calls after that without the username/password)....
 
I hope that makes sense.
 
I hope someone (Scott Battaglia? :) could give me some pointers...
 
Thanks for your time.

----- Original Message ----
From: Robert Lewis <[EMAIL PROTECTED]>
To: [email protected]
Sent: Thursday, October 11, 2007 10:53:31 AM
Subject: Re: Authenticating web service calls via CAS

Hi,

Does the example at http://www.tamu.edu/CAS/libraries/net/
apply in your case?

Thanks.

[EMAIL PROTECTED] wrote:
> Send cas mailing list submissions to
>     [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>     http://tp.its.yale.edu/mailman/listinfo/cas
> or, via email, send a message with subject or body 'help' to
>     [EMAIL PROTECTED]
>
> You can reach the person managing the list at
>     [EMAIL PROTECTED]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of cas digest..."
>
>
> Today's Topics:
>
>    1. Re: CAS Logout with "service" Parameter is not Redirecting to
>      Client    Application (Scott Battaglia)
>    2. JA-SIG Unconference & CAS (Scott Battaglia)
>    3. Anyone have ideas?--Re: Authenticating web service calls via
>      CAS.. (tedzo)
>    4. Re: CAS with JSP (gopu_36)
>    5. Re: CAS with JSP (gopu_36)
>    6. Re: CAS with JSP (gopu_36)
>    7. Re: CAS Logout with "service" Parameter is not Redirecting to
>      Client    Application (Julien Marchal)
>    8. Re: CAS Logout with "service" Parameter is not Redirecting to
>      Client    Application (Julien Marchal)
>    9. CAS in multi-domain DNS (Yannick Quenec'hdu)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 10 Oct 2007 13:36:54 -0400
> From: "Scott Battaglia" <[EMAIL PROTECTED]>
> Subject: Re: CAS Logout with "service" Parameter is not Redirecting to
>     Client    Application
> To: "Yale CAS mailing list" <[email protected]>
> Message-ID:
>     <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Cliff,
>
> You need to set the followServiceRedirects property to true on the
> LogoutController in your XML configuration file.
>
> -Scott
>
> On 10/10/07, Clifford Bryant <[EMAIL PROTECTED]> wrote:
>>  Hello,
>>
>>
>>
>> We are attempting to logout of the CAS application, but the "service"
>> parameter is not redirecting to the client application.
>>
>>
>>
>> Here is the URL that we are sending to CAS logout.
>>
>>
>>
>>
>> https://rsdev01:8443/cas/logout?service=https://rsdev01:8443/terms/CasLogin.jsp
>>
>>
>>
>> It is going to the CAS logout screen, and says "Logout successful," but it
>> is not redirecting back to the client application.
>>
>>
>>
>> Cliff Bryant
>>
>>
>>
>> This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed.  This communication may contain information that is protected from disclosure by applicable law.  If you are not the intended recipient, or the employee or agent responsible for delivering this communication to the intended recipient, be advised that you have received this e-mail in error and any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.  If you believe that you have received this e-mail in error, please immediately notify Edgewater Technology by telephone at (781) 246-3343 and delete the communication from all e-mail files.
>>
>>
>> _______________________________________________
>> Yale CAS mailing list
>> [email protected]
>> http://tp.its.yale.edu/mailman/listinfo/cas
>>
>>
>
>

_______________________________________________
Yale CAS mailing list
[email protected]
http://tp.its.yale.edu/mailman/listinfo/cas



Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user panel and lay it on us.

_______________________________________________ Yale CAS mailing list [email protected] http://tp.its.yale.edu/mailman/listinfo/cas


begin:vcard
fn:Adam Rybicki
n:Rybicki;Adam
org:Unicon, Inc.;Professional Services
adr:Suite 113;;3140 North Arizona Avenue;Chandler;AZ;85225;United States
email;internet:[EMAIL PROTECTED]
tel;work:+1-480-558-2400
tel;home:+1-310-265-8286
tel;cell:+1-310-980-2758
x-mozilla-html:FALSE
url:http://www.unicon.net/
version:2.1
end:vcard

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Yale CAS mailing list
[email protected]
http://tp.its.yale.edu/mailman/listinfo/cas

Reply via email to