{"action":"created","issue":{"url":"https://api.github.com/repos/openwebwork/webwork2/issues/568","labels_url":"https://api.github.com/repos/openwebwork/webwork2/issues/568/labels{/name}","comments_url":"https://api.github.com/repos/openwebwork/webwork2/issues/568/comments","events_url":"https://api.github.com/repos/openwebwork/webwork2/issues/568/events","html_url":"https://github.com/openwebwork/webwork2/issues/568","id":68210138,"number":568,"title":"CAS authentication breaks on session inactivity timeout","user":{"login":"bldewolf","id":457295,"avatar_url":"https://avatars.githubusercontent.com/u/457295?v=3","gravatar_id":"","url":"https://api.github.com/users/bldewolf","html_url":"https://github.com/bldewolf","followers_url":"https://api.github.com/users/bldewolf/followers","following_url":"https://api.github.com/users/bldewolf/following{/other_user}","gists_url":"https://api.github.com/users/bldewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/bldewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bldewolf/subscriptions","organizations_url":"https://api.github.com/users/bldewolf/orgs","repos_url":"https://api.github.com/users/bldewolf/repos","events_url":"https://api.github.com/users/bldewolf/events{/privacy}","received_events_url":"https://api.github.com/users/bldewolf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-04-13T22:40:41Z","updated_at":"2015-04-14T00:55:21Z","closed_at":null,"body":"I'm trying setting up our system to use CAS authentication.  Everything works fine except when a user comes back from an inactive session.  On links where the key is in the path, the user sees a screen that says:\r\n\r\n    Your authentication failed. Please try again. Please speak with your instructor if you need help.\r\n    test_course uses an external authentication system. You've authenticated through that system, but aren't allowed to log in to this course.\r\n\r\nThe user can't actually re-authenticate from this page and has to go back to the home page (or remove the key= GET parameter) to actually re-authenticate and continue using Webwork.\r\n\r\nIs there a way to make Webwork handle this automatically?  I looked at CAS.pm but I'm not familiar enough with Webwork internals to see what to change."},"comment":{"url":"https://api.github.com/repos/openwebwork/webwork2/issues/comments/92549084","html_url":"https://github.com/openwebwork/webwork2/issues/568#issuecomment-92549084","issue_url":"https://api.github.com/repos/openwebwork/webwork2/issues/568","id":92549084,"user":{"login":"bldewolf","id":457295,"avatar_url":"https://avatars.githubusercontent.com/u/457295?v=3","gravatar_id":"","url":"https://api.github.com/users/bldewolf","html_url":"https://github.com/bldewolf","followers_url":"https://api.github.com/users/bldewolf/followers","following_url":"https://api.github.com/users/bldewolf/following{/other_user}","gists_url":"https://api.github.com/users/bldewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/bldewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bldewolf/subscriptions","organizations_url":"https://api.github.com/users/bldewolf/orgs","repos_url":"https://api.github.com/users/bldewolf/repos","events_url":"https://api.github.com/users/bldewolf/events{/privacy}","received_events_url":"https://api.github.com/users/bldewolf/received_events","type":"User","site_admin":false},"created_at":"2015-04-14T00:55:21Z","updated_at":"2015-04-14T00:55:21Z","body":"Sorry, I meant the unless statement.  Basically with this diff applied:\r\n\r\n```diff\r\n--- a/lib/WeBWorK/Authen/CAS.pm\r\n+++ b/lib/WeBWorK/Authen/CAS.pm\r\n@@ -57,18 +57,6 @@ sub get_credentials {\r\n                $self->{credential_source} = 'params';\r\n                debug(\"CAS params user '\", $self->{user_id},\r\n                  \"' key '\", $self->{session_key}, \"'\");\r\n-               # Check session key and user here.  Otherwise, a student can\r\n-               #    determine the enrollment status of any other student if\r\n-               #    they know the userid (which is public information at\r\n-               #    Berkeley).  That would be a privacy violation.\r\n-               my $Key = $r->db->getKey($self->{user_id});\r\n-               unless (defined $Key && $Key->key eq $self->{session_key}) {\r\n-                       debug('undefined or invalid session key:  $Key->key = ',\r\n-                         defined $Key ? $Key->key : undef, ', user value = ',\r\n-                         $self->{session_key});\r\n-                       $self->{error} = \"Invalid session key\";\r\n-                       return 0;\r\n-               }\r\n                return 1;\r\n                #debug(\"falling back to superclass get_credentials\");\r\n                #return $self->SUPER::get_credentials( @_ );\r\n```\r\n\r\nThe session expiration page says this message:\r\n>Your session has expired due to inactivity. test_course uses an external authentication system (e.g., Oncourse, CAS, Blackboard, Moodle, Canvas, etc.). Please return to system you used and enter WeBWorK anew.\r\n\r\nSince CAS is only really intended to replace the login page, this doesn't quite make sense for it.  It would make more sense to bounce them back to the root course page if their session has expired (if that's safer than leaving them on whatever path they were at)."}}