CAS 6.1.3 PM password reset link question.

[William Jojo]

Good morning!

When requesting a password reset from the main CAS login page (not via service) you receive a link like the following:

https://casdev.hvcc.edu/cas/login?pswdrst=TST-1-ATe9S6Bym5Vq8Prk6lMa9Pr86war7Ijf

However, if selected from a service's login page, you get the following

https://casdev.hvcc.edu/cas/login?pswdrst=TST-1-ATe9S6Bym5Vq8Prk6lMa9Pr86war7Ijf&service=https%3A%2F%2Fsite.blackboard.com%2Fwebapps%2Fbb-auth-provider-cas-BB5ca8ab8e56369%2Fexecute%2FcasLogin%3Fcmd%3Dlogin%26authProviderId%3D_124_1%26redirectUrl%3Dhttps%253A%252F%252Fhvcc-site.blackboard.com%252Fwebapps%252Fportal%252Fexecute%252FdefaultTab%26globalLogoutEnabled%3Dtrue

Not sure the service needs to be on this link. As I understand it, the transient service ticket is a one shot directed at the password reset component, so I am uncertain why the service would be necessary as the link also works with the ?service portion removed.

Is this something that ought to be removed from the link?

Thank you! 

Bill

[Misagh Moayyed]

Not sure the service needs to be on this link. As I understand it, the transient service ticket is a one shot directed at the password reset component, so I am uncertain why the service would be necessary as the link also works with the ?service portion removed.

Is this something that ought to be removed from the link?

No. 

Let's say you start with Service A and attempt to login via CAS, and then you are forced to reset your password. When you have completed the password flow, the service parameter is re-collected again to redirect you back to Service A, so you can resume.

The service parameter is always optional, whether you're resetting passwords or doing anything else.