3

I tried to do SSO with web services with jasig CAS.

I did the security for web application using spring filters, but I don't know how to do it with web services on the server side.

MatthewMartin
  • 32,326
  • 33
  • 105
  • 164
Wojciech
  • 31
  • 1
  • 2

1 Answers1

2

We do this with a combination of the rest client (https://wiki.jasig.org/display/CASUM/RESTful+API) and the CasLoginModule (https://wiki.jasig.org/display/CASC/CASLoginModule+for+JAAS+applications) through JAAS (https://wiki.jasig.org/display/CASUM/JAAS) . It works like this:

enter image description here

The client sends down a username and password to your web service who authenticates and validates this against the CAS server. After this, the CASLoginModule caches the resulting service ticket so that future requests that can provide a service ticket don't need to contact CAS again.

This is quite a long way out of the "normal" usage of CAS because essentially it makes the service ticket a long lived item. Normally the ST should last long enough for the resulting service to validate the client. In my case I figured that it doesn't matter too much because all of our communication is on the server-side behind a firewall but this may be different for you.

bwobbones
  • 2,398
  • 3
  • 23
  • 32
  • In my case client is called from a web application where user is already logged. Cas made a ticket. Is it possible to pass a ticket into server web service and validete it? – Wojciech Jul 25 '11 at 14:20
  • Yes, for this we construct our own secure cookie (requires https) and pass it back to the web application client for them to pass back in on the next request. The CasLoginModule will cache the service ticket and so the validation will succeed. It's also possible to extend the validation life of the service ticket in the ticket registry - see here: https://wiki.jasig.org/display/CASUM/Ticket+Expiration+Policy – bwobbones Jul 26 '11 at 14:16
  • Is possible to pass it in SAML Assertion header in SOAP? – Wojciech Jul 28 '11 at 10:39
  • Not sure - this sounds like a different question...maybe ask with a #SAML tag? – bwobbones Jul 28 '11 at 23:29