This section describes how to authenticate to a service using CAS. In other words,
this section discusses how to setup a client that uses a service that authenticates with
CAS. The next section describes how to setup a stateless service to Authenticate
using CAS.
In order to authenticate to a stateless service, the application needs to obtain a proxy granting ticket
(PGT). This section describes how to configure Spring Security to obtain a PGT building upon then
Service Ticket Authentication
configuration.
The first step is to include a
ProxyGrantingTicketStorage
in your Spring Security
configuration. This is used to store PGT's that are obtained by the
CasAuthenticationFilter
so that they can be used to obtain proxy tickets. An example
configuration is shown below
NOTE: In a real application you should not use an in memory implementation. You will also want
to ensure to clean up expired tickets by calling ProxyGrantingTicketStorage.cleanup()
<bean id="pgtStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl"/>
The next step is to update the
CasAuthenticationProvider
to be able to obtain proxy
tickets. To do this replace the
Cas20ServiceTicketValidator
with a
Cas20ProxyTicketValidator
. The
proxyCallbackUrl
should be set to
a URL that the application will receive PGT's at. Last, the configuration should also reference the
ProxyGrantingTicketStorage
so it can use a PGT to obtain proxy tickets.
You can find an example of the configuration changes that should be made below.
<bean
id
=
"casAuthenticationProvider"
class
=
"org.springframework.security.cas.authentication.CasAuthenticationProvider"
>
<property
name
=
"ticketValidator"
>
<bean
class
=
"org.jasig.cas.client.validation.Cas20ProxyTicketValidator"
>
<constructor-arg
value
=
"https://localhost:9443/cas"
/>
<property
name
=
"proxyCallbackUrl"
value
=
"https://localhost:8443/cas-sample/j_spring_cas_security_proxyreceptor"
/>
<property
name
=
"proxyGrantingTicketStorage"
ref
=
"pgtStorage"
/>
</bean>
</property>
</bean>
The last step is to update the
CasAuthenticationFilter
to accept PGT and to store them
in the
ProxyGrantingTicketStorage
. It is important the the
proxyReceptorUrl
matches the
proxyCallbackUrl
of the
Cas20ProxyTicketValidator
. An example
configuration is shown below.
<bean
id
=
"casFilter"
class
=
"org.springframework.security.cas.web.CasAuthenticationFilter"
>
<property
name
=
"proxyGrantingTicketStorage"
ref
=
"pgtStorage"
/>
<property
name
=
"proxyReceptorUrl"
value
=
"/j_spring_cas_security_proxyreceptor"
/>
</bean>
Now that Spring Security obtains PGTs, you can use them to create proxy tickets which can be used to authenticate
to a stateless service. The
CAS sample application
contains a working example in
the
ProxyTicketSampleServlet
. Example code can be found below:
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
// NOTE: The CasAuthenticationToken can also be obtained using
// SecurityContextHolder.getContext().getAuthentication()
final CasAuthenticationToken token = (CasAuthenticationToken) request.getUserPrincipal();
// proxyTicket could be reused to make calls to the CAS service even if the
// target url differs
final String proxyTicket = token.getAssertion().getPrincipal().getProxyTicketFor(targetUrl);
// Make a remote call using the proxy ticket
final String serviceUrl = targetUrl+"?ticket="+URLEncoder.encode(proxyTicket, "UTF-8");
String proxyResponse = CommonUtils.getResponseFromServer(serviceUrl, "UTF-8");
