TGC timeout issue

[Boris P1]

Good morning,

I'am working on the "Remember Me" feature of CAS v5.3.

Thanks to the Maven overlay, in order to make the TGT timeout depend on the last service access, i made the Long-Term Ticket Granting Ticket support a TimeoutExpirationPolicy instead of HardTimeoutExpirationPolicy, in the RememberMe-enabled case:

https://github.com/apereo/cas/blob/5.3.x/core/cas-server-core-tickets/src/main/java/org/apereo/cas/config/CasCoreTicketsConfiguration.java#L297

At the 297 line, i put TimeoutExpirationPolicy instead of HardTimeoutExpirationPolicy (and made others works...).

But i'm wondering if it's possible to give an extension for the CAS cookie lifetime according to the last service access.

In others words, does the Long-Term Ticket Granting Cookie have the capability to support a TimeoutExpirationPolicy like the Long-Term Ticket Granting Ticket does?

TGC infos:

https://github.com/apereo/cas/blob/5.3.x/core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/TGCCookieRetrievingCookieGenerator.java

https://github.com/apereo/cas/blob/5.3.x/core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/CookieRetrievingCookieGenerator.java

https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties.html#ticket-granting-cookie

https://apereo.github.io/cas/5.3.x/protocol/CAS-Protocol-Specification.html#415-long-term-ticket-granting-cookie-properties

[Ray Bon]

Boris,

The TGC is only used as a way to 'find' the TGT. As long as the TGT is valid, the cookie is valid. By default, TGC is valid for the session, maxAge = -1.

There is a most recently used option for TGT, https://apereo.github.io/cas/6.1.x/ticketing/Configuring-Ticket-Expiration-Policy.html#timeout

Ray

-- 

Ray Bon

Programmer Analyst

Development Services, University Systems

2507218831 | CLE 019 | rb...@uvic.ca

I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations.

[Boris P1]

Eventually, i let the default configuration (HardTimeoutExpirationPolicy).

Thank you for your response, rbon, and sorry for my late response,

Boris.