{"action":"created","issue":{"url":"https://api.github.com/repos/Jasig/cas/issues/780","labels_url":"https://api.github.com/repos/Jasig/cas/issues/780/labels{/name}","comments_url":"https://api.github.com/repos/Jasig/cas/issues/780/comments","events_url":"https://api.github.com/repos/Jasig/cas/issues/780/events","html_url":"https://github.com/Jasig/cas/pull/780","id":50313396,"number":780,"title":"3.5.2.1 cookie lookup while retrieving TGT-id","user":{"login":"astik","id":572233,"avatar_url":"https://avatars.githubusercontent.com/u/572233?v=3","gravatar_id":"","url":"https://api.github.com/users/astik","html_url":"https://github.com/astik","followers_url":"https://api.github.com/users/astik/followers","following_url":"https://api.github.com/users/astik/following{/other_user}","gists_url":"https://api.github.com/users/astik/gists{/gist_id}","starred_url":"https://api.github.com/users/astik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/astik/subscriptions","organizations_url":"https://api.github.com/users/astik/orgs","repos_url":"https://api.github.com/users/astik/repos","events_url":"https://api.github.com/users/astik/events{/privacy}","received_events_url":"https://api.github.com/users/astik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2014-11-27T17:41:42Z","updated_at":"2015-04-11T10:10:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Jasig/cas/pulls/780","html_url":"https://github.com/Jasig/cas/pull/780","diff_url":"https://github.com/Jasig/cas/pull/780.diff","patch_url":"https://github.com/Jasig/cas/pull/780.patch"},"body":"Here is a simple change to check the cookie while retrieving the TGT-Id ; before that, TGT-Id was only retrieved from the {ticketGrantingTicketId} mapping (/v1/tickets/{ticketGrantingTicketId}).\r\n\r\nThis change answers this matter :\r\n- John is connecting to an application A. Very classic CAS application, John is redirected to CAS, authentifies, gets a TG Cookie, is redirected back to his application with a ST which is validated between Application A and CAS : John is authentified on application A and has a TGCookie on CAS domain.\r\n- John go to a page on application A that use a webservice W on the front side. W is also protected by CAS. John needs a ST to get to webservice W.\r\n- we don't want John to authenticate himself on the CAS REST API as we don't have its credential. Also, we don't want to ask John for his credential once again (this time through Application A and not through CAS)\r\n\r\nWebservice W is called from Application A's domain through AJAX with CORS enable. To get a new ST to reach webservice W, we need to call CAS with AJAX (/v1/tickets/xxxx), but we don't have the TGT-Id information (the xxxx part of the URL). What we know is that John is authenticated on CAS and have a TGCookie on CAS domain. So that, we will enable this cookie to be send with the AJAX request on CAS (with the withCredentials feature : http://quickleft.com/blog/cookies-with-my-cors). That way, the TGT-id will be send to CAS and we can get the ST without having access to credentials on application A's domain.\r\n\r\nOf course, we can turn our architecture to Oauth ... but it is way less easy to set up than a classic CAS server."},"comment":{"url":"https://api.github.com/repos/Jasig/cas/issues/comments/91817781","html_url":"https://github.com/Jasig/cas/pull/780#issuecomment-91817781","issue_url":"https://api.github.com/repos/Jasig/cas/issues/780","id":91817781,"user":{"login":"astik","id":572233,"avatar_url":"https://avatars.githubusercontent.com/u/572233?v=3","gravatar_id":"","url":"https://api.github.com/users/astik","html_url":"https://github.com/astik","followers_url":"https://api.github.com/users/astik/followers","following_url":"https://api.github.com/users/astik/following{/other_user}","gists_url":"https://api.github.com/users/astik/gists{/gist_id}","starred_url":"https://api.github.com/users/astik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/astik/subscriptions","organizations_url":"https://api.github.com/users/astik/orgs","repos_url":"https://api.github.com/users/astik/repos","events_url":"https://api.github.com/users/astik/events{/privacy}","received_events_url":"https://api.github.com/users/astik/received_events","type":"User","site_admin":false},"created_at":"2015-04-11T10:10:01Z","updated_at":"2015-04-11T10:10:01Z","body":"I know what the proxy cas is but i don't understand what it has to do with our problem here.\r\nI never meant to use TGC outside of CAS, it is only use, as usual, between the end-user and the CAS server as it is a cookie set on the CAS domain.\r\n\r\nMy problematic is a frontend only application, only static file. There is no backend for the application. The application use webservice which are CAS protected and don't have Proxy CAS feature, nor I want them to have it. I want to keep the webservice as simple as possible.\r\n\r\nSo my frontend application (Angular App) will use the webservice and no communication is made from webservice A to webservice B ... only the frontend application calls the webservice, that mean, it is the end-user that calls directly the webservice.\r\nI am in a scenario like a simple CAS one, except the HTTP calls are made with the ajax engine instead as explicit URL change in the browser ... from an HTTP point of view it is the same. But as the AJAX engine is headless, i can't rely on the classic CAS redirection process and i need the REST plugin to expose a simple way to exchange with CAS server (ie not through HTML).\r\nThat being said, I want to be able a transparent access to a protected resource while being authenticated on CAS. That is what CAS is doing with regular user navigation, that is what I'd want with AJAX call. Once again, I don't see how proxy will help me in this.\r\n\r\nFirst access to WS1, user not authenticated neither on WS1, nor CAS\r\n```\r\nBrowser                  WS1                                    WS2                      CAS\r\n ------------------------>\r\n***** user is not authenticad on WS1 *********\r\n <--------------- REDIRECT TO CAS\r\n REDIRECT TO CAS REST API --------------------------------------------->\r\n***** user is not authenticad on CAS *********\r\n <---------------------------------------------------------------------------------- ERROR\r\n\r\n REDIRECT TO CAS LOGIN FORM ---------------------------------------->\r\n <--------------------------------------------------------------------------------- LOGIN FORM\r\n AUTH ------------------------------------------------------------------------------->\r\n ***** user is authenticad on CAS *********\r\n<------------------------------------------------------------------------------------- ST\r\n ST ---------------->\r\n ***** user is authenticad on WS1 *********\r\n <----------------- JSON\r\n```\r\n\r\nFirst access to WS2, user authenticated on CAS, not on WS2\r\n```\r\n ------------------------------------------------------------>\r\n***** user is not authenticad on WS2 *********\r\n <--------------- REDIRECT TO CAS\r\n REDIRECT TO CAS REST API --------------------------------------------->\r\n***** user is authenticad on CAS *********\r\n<------------------------------------------------------------------------------------- ST\r\nST --------------------------------------------------------->\r\n ***** user is authenticad on WS2 *********\r\n <--------------------------------------------------------- JSON\r\n```\r\n\r\nI think this cinematic is very close what CAS does as a not-proxy configuration."}}