CAS implements single sign-on process

CAs for single sign-on

Environment

Client: www.app1.com

CAS server: www.cas-server.com

1. Browser: initiating the request www.app1.com

2. Client: Authenticationfilter Discovery session is empty, ticket is empty, redirect and save service Https://www.cas-server.com/cas/login?service=http ://www.web.com/app

3. CAS server: Show login page, provide Username/password to user authentication by default

4. Browser: Input Username/password

5. CAS server: Username/password Authentication to user input, if passed generates Ticket granting Ticket, to the server (default is the Map type of cache), and the TGT ID as content is created Cooki E and sent to the browser.

6. CAS server: Generate service ticket via TGT. Redirect to Www.app1.com?ticket=ST-xxx

7. Client: Authenticationfilter filter found in URL ticket, skip Authenticationfilter filter, arrive Cas20proxyreceivingticketvalidationfilter Filter

8. Client: Cas20proxyreceivingticketvalidationfilter filter, use 7 ticket and service as parameter verification

9. Client: Request CAS server Authentication https://www.cas-server.com/cas/serviceValidate?ticket=ST-xxx&&service=http://www.app1.com

10. Client : Parse CAS server return information, generate assertion (including username, validate info, etc.)

11. The client setting assertion is the _const_cas_assertion_ attribute of the request, and the assertion is logged to the session.

12. Client: access the Http://www.web.com/app service through the servlet to end the validation of CAs.

User successfully logged in, not first time access:

13. Client accesses www.app1.com by redirection

14. Client Authenticationfilter Filter found in session assertion, end this filter, transfer to the next filter cas20proxyreceivingticketvalidationfilter .

15. Customer segment Cas20proxyreceivingticketvalidationfilter found that the URL of this visit is not ticket, end this filter, transfer to the next filter, continue to execute the subsequent filter, access through the servlet Http://www.web.com/app Services.

User access to another application:

16. Browser: Request www.app2.com

17. Client: Redirected to CAS Server,cas Server proactively receives TGC cookie

18.CAS server: If user holds TGC and it hasn't expired, then go Step6, achieve SSO effect, if TGC fail, then the user still need to re-authenticate (go STEP3).

CAS implements single sign-on process