What configuration for ticket 5.2 ?

[vallee.romain]

Hello,

i try to setup jasig TGC for this use case :

When i check rememberMe : 1 months without need to enter login.password

When i don't check rememberme : 7 hours unless i close the brother . If i close the brother, i would like to have login/password prompte at next login.

I think rememberMe if ok .

But when i try to closed/open the brother, the session is already up .

# cas.tgc.path=

cas.tgc.maxAge=-1

# cas.tgc.domain=

cas.tgc.name=TGC

cas.tgc.secure=false

cas.tgc.rememberMeMaxAge=1350000

cas.tgc.encryptionKey=xxxxxxxxxxx

cas.tgc.signingKey=xxxxxxxxxxxxxxxxx

cas.tgc.cipherEnabled=true

# #remember me 31 days in seconds

# # Set to a negative value to never expire tickets

cas.ticket.tgt.maxTimeToLiveInSeconds=1350000

cas.ticket.tgt.timeToKillInSeconds=7200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

cas.ticket.tgt.timeout.maxTimeToLiveInSeconds=1350000

##

#Throttled Timeout

##

cas.ticket.tgt.throttledTimeout.timeToKillInSeconds=28800

cas.ticket.tgt.throttledTimeout.timeInBetweenUsesInSeconds=5

cas.ticket.tgt.hardTimeout.timeToKillInSeconds=28800

Have you got an idea ?

Best regards

Romain

[Man H]

Try this

cas.ticket.tgt.maxTimeToLiveInSeconds=25200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=2592000

To test these set lower values.

Also dont use secure=false

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d8c90dba-d149-4ff5-871e-31c38c8722ba%40apereo.org.

[vallee.romain]

Thank you for your answer .

Now i got this

cas.tgc.maxAge=-1

# cas.tgc.domain=

cas.tgc.name=TGC

#cas.tgc.secure=false

#cas.tgc.rememberMeMaxAge=1350000

cas.tgc.encryptionKey=kGF9P2ZuU0ovlaCWxhiHix1bxH2pGfqlG5qGzqdxjY4

cas.tgc.signingKey=K5yrl7ThQ5wwX8pbtEgdHF4aDuwUwFkHmhARzSRdNvNpXF1FFk_sYIgRHZZVJWdlMlGecQ-bePNlf0pexIzj2A

cas.tgc.cipherEnabled=true

# #remember me 31 days in seconds

# # Set to a negative value to never expire tickets

cas.ticket.tgt.maxTimeToLiveInSeconds=25200

#cas.ticket.tgt.timeToKillInSeconds=7200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

#cas.ticket.tgt.timeout.maxTimeToLiveInSeconds=1350000

##

#Throttled Timeout

##

#cas.ticket.tgt.throttledTimeout.timeToKillInSeconds=28800

#cas.ticket.tgt.throttledTimeout.timeInBetweenUsesInSeconds=5

#cas.ticket.tgt.hardTimeout.timeToKillInSeconds=28800

And session keep alive when i close my web browser . :'(

Try this

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

[Man H]

Put only those properties. 

To end your cas session you have to logout  redirect to login page from your application otherwise you will get that behaviour.

El martes, 27 de febrero de 2018, vallee.romain <vallee...@gmail.com> escribió:

Thank you for your answer .

Now i got this

cas.tgc.maxAge=-1

# cas.tgc.domain=

cas.tgc.name=TGC

#cas.tgc.secure=false

#cas.tgc.rememberMeMaxAge=1350000

cas.tgc.encryptionKey=kGF9P2ZuU0ovlaCWxhiHix1bxH2pGfqlG5qGzqdxjY4

cas.tgc.signingKey=K5yrl7ThQ5wwX8pbtEgdHF4aDuwUwFkHmhARzSRdNvNpXF1FFk_sYIgRHZZVJWdlMlGecQ-bePNlf0pexIzj2A

cas.tgc.cipherEnabled=true

# #remember me 31 days in seconds

# # Set to a negative value to never expire tickets

cas.ticket.tgt.maxTimeToLiveInSeconds=25200

#cas.ticket.tgt.timeToKillInSeconds=7200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

#cas.ticket.tgt.timeout.maxTimeToLiveInSeconds=1350000

##

#Throttled Timeout

##

#cas.ticket.tgt.throttledTimeout.timeToKillInSeconds=28800

#cas.ticket.tgt.throttledTimeout.timeInBetweenUsesInSeconds=5

#cas.ticket.tgt.hardTimeout.timeToKillInSeconds=28800

And session keep alive when i close my web browser .

Le mardi 27 février 2018 13:29:34 UTC+1, Manfredo Hopp a écrit :

Try this

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d8c90dba-d149-4ff5-871e-31c38c8722ba%40apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/10e4c78f-d647-4ea8-aed6-7bfded1a6887%40apereo.org.

[Man H]

 As for tgc properties leave them unchanged.

 Pd: closing browser does not end cas session.

Put only those properties. 

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/10e4c78f-d647-4ea8-aed6-7bfded1a6887%40apereo.org.

[Ray Bon]

Romain,

I guess cas.tgc.remeberMeMaxAge overrides cas.tgc.maxAge.

If you want your session to end when browser is closed, leave out cas.tgc.rememberMeMaxAge.

Ray

-- 
Ray Bon
Programmer analyst
Development Services, University Systems
2507218831 | CLE 019 | rb...@uvic.ca

[vallee.romain]

Thank you all for your response.

I'm surprised the TGC stays after the browser closes.

For me, if we didn't check "Remember Me", we had authentication per session and not a cookie.

cas.tgc.name=TGC

#cas.tgc.secure=false

#cas.tgc.rememberMeMaxAge=1350000

cas.tgc.encryptionKey=kGF9P2ZuU0ovlaCWxhiHix1bxH2pGfqlG5qGzqdxjY4

cas.tgc.signingKey=K5yrl7ThQ5wwX8pbtEgdHF4aDuwUwFkHmhARzSRdNvNpXF1FFk_sYIgRHZZVJWdlMlGecQ-bePNlf0pexIzj2A

cas.tgc.cipherEnabled=true

# #remember me 31 days in seconds

# # Set to a negative value to never expire tickets

cas.ticket.tgt.maxTimeToLiveInSeconds=25200

#cas.ticket.tgt.timeToKillInSeconds=7200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

#cas.ticket.tgt.timeout.maxTimeToLiveInSeconds=1350000

This is my new configuration.

but the TGC cookie still remains after the closing of the web browser.

In version 4.2 of jasig, if we closed the browser, the session was no longer maintained.

[Man H]

Check maxage within cookie

--

- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/6c3297a3-0c5e-478e-ba81-0a4857dc6f5c%40apereo.org.

[vallee.romain]

Without check rememberme.

the tgc cookie is present .

And for cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

I don't find documentation on tgt , tgc ... :(

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

[Man H]

Cookies hace maxage inside what says yours

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/4ac13b2f-6f76-4fc5-a725-de306a8972fe%40apereo.org.

[vallee.romain]

i don't find maxage into the cookie

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/4ac13b2f-6f76-4fc5-a725-de306a8972fe%40apereo.org.

[Man H]

its expires

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c01f8ab4-20c1-460f-bccd-7798ecc97d53%40apereo.org.

[Ray Bon]

Romain,

You still need cas.tgc.maxAge=-1. No sure what the default is (may be a couple weeks) but setting a cookie maxAge to less than 0 will cause the cookie to be discarded by the browser when it closes. It will stay active in the browser as long as the browser is open, the lifetime of the CAS session can be managed with cas.ticket.tgt properties.

Ray

[vallee.romain]

Thank you Rbon, 

I just try with maxage=-1

but session is stile alive without check rememberMe checkbox.

and a 

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000 is generate .

# cas.tgc.path=

cas.tgc.maxAge=-1

# cas.tgc.domain=

cas.tgc.name=TGC

#cas.tgc.secure=false

#cas.tgc.rememberMeMaxAge=1350000

cas.tgc.encryptionKey=kGF9P2ZuU0ovlaCWxhiHix1bxH2pGfqlG5qGzqdxjY4

cas.tgc.signingKey=K5yrl7ThQ5wwX8pbtEgdHF4aDuwUwFkHmhARzSRdNvNpXF1FFk_sYIgRHZZVJWdlMlGecQ-bePNlf0pexIzj2A

cas.tgc.cipherEnabled=true

# #remember me 31 days in seconds

# # Set to a negative value to never expire tickets

cas.ticket.tgt.maxTimeToLiveInSeconds=25200

#cas.ticket.tgt.timeToKillInSeconds=7200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

May be it's a bug?

[Ray Bon]

To be clear, what do you mean by 'session'?

CAS has a login session identified by the life of the TGT.

Your application (service) has a session identified by whatever mechanism it chooses (probably a cookie).

Your browser has a session with CAS identified by TGC.

Each of these 'sessions' can expire without impact of any other.

cas.tgc.maxAge=-1 only affects TGC and requires your browser to be closed (maybe even all windows). When the TGC is removed, no new SSO will take place (no way to recover TGT). When TGT expires, no new SSO will take place. To end your session on the service, you have to log out of the service or remove the cookies it sets (perhaps set its maxAge=-1).

Ray

[vallee.romain]

Thank you Ray for your anwser.

But, when cas.tgc.maxAge=-1, it's doesn't affect TGC ticket and when i restart browser, TGC is not removed.

I connect to my cas server :

Without rememberMe

SuccessFull

I close my browser and i open.

and i'm still connected 

and yet my cas.tgc.maxAge value is -1

[Ray Bon]

Looked at my config again and noticed this (not sure how I missed it before):

# default is P14D

# used to set maxAge on user selection of remember me at login

# it is always set regardless of user choice; this is a bug to investigate

# file: https://github.com/apereo/cas/blob/5.1.x/support/cas-server-support-cookie/src/main/java/org/apereo/cas/web/support/CookieRetrievingCookieGenerator.java

cas.tgc.rememberMeMaxAge=-1

Try setting cas.tgc.rememberMeMaxAge to -1 as well.

I just have not had time to dig into this.

Ray

[vallee.romain]

HI ray,

try cas.tgc.rememberMeMaxAge instead of which value ?

cas.tgc.maxAge=-1

# cas.tgc.domain=

cas.tgc.name=TGC

#cas.tgc.secure=false

#cas.tgc.rememberMeMaxAge=1350000

cas.tgc.encryptionKey=kGF9P2ZuU0ovlaCWxhiHix1bxH2pGfqlG5qGzqdxjY4

cas.tgc.signingKey=K5yrl7ThQ5wwX8pbtEgdHF4aDuwUwFkHmhARzSRdNvNpXF1FFk_sYIgRHZZVJWdlMlGecQ-bePNlf0pexIzj2A

cas.tgc.cipherEnabled=true

# #remember me 31 days in seconds

# # Set to a negative value to never expire tickets

cas.ticket.tgt.maxTimeToLiveInSeconds=25200

#cas.ticket.tgt.timeToKillInSeconds=7200

cas.ticket.tgt.rememberMe.enabled=true

cas.ticket.tgt.rememberMe.timeToKillInSeconds=1350000

What is P14D ??

[vallee.romain]

I find, may be its a bug !!

https://github.com/apereo/cas/pull/3176

[Ray Bon]

Set it to -1.

Ray

[vallee.romain]

But -1 to rememberme i will have Infinite Time cookie,no ?

[Ray Bon]

I think there is a bug with the way the values are processed (just have not had time to verify). What you want is your cookie to have a maxAge of -1. Oddly, the rememberMeMaxAge will be used to set this value.

The cookie will last as long as your browser is open. When your browser closes the cookie will be removed. 

Ray

On Mon, 2018-03-05 at 12:35 -0800, vallee.romain wrote:

But -1 to rememberme i will have Infinite Time cookie,no ?