REST Endpoints and Unencrypted TGT

[Mallory, Erik]

Hello,

I am working towards a functional REST login. Using the documentation and examples, I was able to put together a proof of concept in php, that logs in to CAS, retrieves an unencrypted TGT which can’t be validated. Since the TGTs are configured to be encrypted, I assumed I’d be getting an encrypted TGT back, so I could set a cookie that would facilitate SSO authentication.

When I log in to CAS via the CAS delivered login, my browser receives a cookie called TGC that is encrypted, I assume this is the encrypted TGT.

What am I missing?  Guidance is greatly appreciated.

Thanks,

Erik Mallory

Server Analyst 

Wichita State University

 

[Misagh Moayyed]

Hello,

I am working towards a functional REST login. Using the documentation and examples, I was able to put together a proof of concept in php, that logs in to CAS, retrieves an unencrypted TGT which can’t be validated.

How would you validate it?

Since the TGTs are configured to be encrypted, I assumed I’d be getting an encrypted TGT back, so I could set a cookie that would facilitate SSO authentication.

When I log in to CAS via the CAS delivered login, my browser receives a cookie called TGC that is encrypted, I assume this is the encrypted TGT.

No, it isn't.

What am I missing?  Guidance is greatly appreciated.

Nothing. This is functioning as designed. 

There is the ability to encrypt tickets that are shared with the rest of the world but one, that has nothing to do with the cookie, two it's an auxiliary feature and finally, there isn't anything you can do with it on the app front. It's also entirely likely that rest API doesn't support the usual ticket encryption functionality, but since you don't mention what CAS version, (sort of an important detail) I can't say for sure.

-- Misagh

[Mallory, Erik]

Thanks for the quick response. I’m using cas version 5.1.1

Using my  REST login,

I request a TGT using a POST with the username and password to the cas/v1/ticket endpoint

When I receive the TGT I request a Service Ticket using the same endpoint with the TGT concatenated to the end of the url

I then attempt to validate the ticket using the /p3/servicValidate?service=<service>&ticket=<ST>

Which returns : Ticket <string> not recognized

I know the life span of an ST is 10 seconds and it’s good for one validation. 10 seconds more than enough time to validate, and I don’t see how this ticket could be sent off for validation before I sent it to be validated.

 

I’d expect to be able to put what was received from the rest endpoints (the TGT) in a cookie and be authenticated. Obviously, I’m wrong.

Understand that I’m not building an app here. My institution has a desire to have a “spash” page with campus news useful links, etc, and a CAS login that when used, logs them into our portal.

 

I think CAS REST is functioning as designed as well, I’m just trying to use it.

Erik Mallory

Server Analyst 

Wichita State University

 

 

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/310591097.4326952.1503584932377.JavaMail.zimbra%40unicon.net.

[Misagh Moayyed]

 

I’d expect to be able to put what was received from the rest endpoints (the TGT) in a cookie and be authenticated. Obviously, I’m wrong.

If I am reading things right, this bit is key. When you handle and do things with REST, you're "on your own". You're responsible for cookies (or not) if you wish to manage the SSO session. It's up to you, because you're handed the TGT and you get to decide what to do with it. You are the CAS server, essentially. If you want the CAS server to be a CAS server handling sso then you need to find a different authentication mode. REST won't do. With this, it's just brokering authentication. 

You will also need to look into logs to figure out what happens to that ticket. Needless to say, you can only validate it once, and you cant pass it onto something else. For that you need proxy tickets.

--

--Misagh

[Mallory, Erik]

Much obliged sir, I’ll keep at it. Thanks for your time.

 

Erik Mallory

Server Analyst 

Wichita State University

 

 

From: <cas-...@apereo.org> on behalf of Misagh Moayyed <mmoa...@unicon.net>
Reply-To: "cas-...@apereo.org" <cas-...@apereo.org>
Date: Thursday, August 24, 2017 at 11:40 AM
To: "cas-...@apereo.org" <cas-...@apereo.org>
Subject: Re: [cas-user] REST Endpoints and Unencrypted TGT

 

 

 

I’d expect to be able to put what was received from the rest endpoints (the TGT) in a cookie and be authenticated. Obviously, I’m wrong.

 

--

--Misagh

--

- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2135284935.4347486.1503592845208.JavaMail.zimbra%40unicon.net.

[Misagh Moayyed]

Always a pleasure. Post back any and all findings. 

---

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/08D52D3F-D5D2-4F2D-A13E-A185A0FF73C2%40wichita.edu.

--

--Misagh