Use of CAS generated JWT instead of Proxy Ticket

[Konstantin]

We consider using CAS generated JWT instead of Service Ticket. We also face a proxy like use case described here. Why would we go into complexities of the CAS proxy call flow when user facing service may simply supply JWT to the secondary service instead of dealing with Proxy Ticket? Do we miss something here or indeed using JWT makes handling the proxy use case much simpler? Thank you for sharing your opinion.

[Drew Liscomb]

Hi Konstantin,

If you have complete control over the client, then the JWT route may indeed be 'easier'.  Until v5.3.7, one limiting factor was that all JWTs were created using a single set of signing & encryption keys.  That implementation doesn't allow for JWTs to be distributed to many different 3rd parties, over which we have little control.  Fortunately, v5.3.7 was re-architected to allow for per-service JWT keys, and this shouldn't be an issue any more.

Thinking about it for a moment:

* Using a JWT 'freezes' into the two keys the method of establishing trust between parties.  By that, I mean that you would have to re-configure CAS to use new keys AND then re-configure the client.

* Using the CAS ServiceTicket method of establishing trust is more 'dynamic' as it requires the client to validate the ServiceTicket in each authentication session, but no re-configuration would be necessary if the keys were compromised.

Kind regards,

Drew

On Wed, Feb 27, 2019 at 2:17 PM Konstantin <kzi...@gmail.com> wrote:

We consider using CAS generated JWT instead of Service Ticket. We also face a proxy like use case described here. Why would we go into complexities of the CAS proxy call flow when user facing service may simply supply JWT to the secondary service instead of dealing with Proxy Ticket? Do we miss something here or indeed using JWT makes handling the proxy use case much simpler? Thank you for sharing your opinion.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/fbb07e35-1c17-4485-9265-bf9453417dac%40apereo.org.