Download Flexible authentication for stateless web services

<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>myuser</cas:user>
</cas:proxyGrantingTicket>
</cas:authenticationSuccess>
</cas:serviceResponse>
If the ticket validation fails (e.g. ticket time out) , the answer is something like
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationFailure code="INVALID_TICKET">
Ticket ST-6-3WsfnsTJ41qi4Y95cjre-cas not recognized
</cas:authenticationFailure>
</cas:serviceResponse>
During this process a TGT and a ST have been created. The ST in only valid for a few
seconds (configurable) and must be validated within this time period. Such a ticket
can be used only once. A second validation would result in an error.
3.5.1.2 Protocol Elements
Terminology used for protocol description:
–
–
–
–
“Client” refers to the user and/or the web browser.
“Server” refers to the CAS server.
“Service” refers to the application the clients wants to access.
“Back-end” or “target service” is an application the service is trying to access
on behalf of the client. (Proxy capabilities)
As seen in the above description some predefined URLs were used like “http://uxserver02:8080/cas/serviceValidate” and “http://ux-server02:8080/cas/login”. In these
URIs “cas” is the context root of the web application and may differ.
“/serviceValidate” and “/login” are predefined URIs (Uniform Resource Identifier)
defined by the CAS protocol.
The “/login” URI can act as credential requester and as credential acceptor.
As a requester the following parameters can be passed:
–
service (optional)
The URL the client is redirected to after successful SSO authentication. This
URL contains the “ticket” parameter and the value is a ST. If the URL is
missing no redirection takes place.
If the user is not actually signed in he is challenged for credentials. After
successful SSO login a TGT is created and TGC is sent back. Clients having a
valid TGC already are not challenged for credentials. (Only for SSL
connections)
49