0

I have two separate Grails applications that use the JASIG CAS Client Plugin. When my applications run, different users can authenticate against my CAS server (using the client plugin).

Authentication aside, I use a Grails Filter for authorization in both applications. A user may be authenticated, but I want to make sure that only certain users can only access the appropriate application.

Everything works, except for the below scenario:

  1. I successfully authenticate against the CAS server with username "jack" and I am authorized to use Application A.
  2. I close Application A and sign out of CAS.
  3. I successfully authenticate against the CAS server with username "jill", but I am not authorized to use the Application B because the username from the session is still "jack"

Do I need to flush the session at any point when my applications initiate? If so, how can I do that? Here is the code for my Filter:

import edu.yale.its.tp.cas.client.filter.CASFilter

class SecurityFilters {
    def filters = {
        loginCheck(controller: '*', action: '*') {
            before = {

                def username = session?.getAttribute(CASFilter.CAS_FILTER_USER)?.toLowerCase()

                if (username in grailsApplication.config.users) {
                    return true
                } else {
                    render view: '/invalid_user', model: [username: username]
                    return false
                }
            }
        }
    }
}
littleK
  • 19,521
  • 30
  • 128
  • 188
  • Does your logout remove the session attribute? –  Jan 29 '13 at 16:51
  • Right now I do not have a logout button within each application. Is that what I would need? If so, would it simply be a 'session.invalidate()'? What I don't like about that is that if the user just closes the window, without clicking "Logout", then the session would not be removed... – littleK Jan 29 '13 at 17:04
  • http://stackoverflow.com/questions/9435602/cas-logout-and-cookies-elimination Maybe is this what's happening for you? –  Jan 29 '13 at 17:29

0 Answers0