The ticket is only validated if the service= presented in the validation matches the service= on the request. The Browser was redirected back to the URL specified by that service. So generally if foo.com redirects to CAS with service=foo.com, and then gets back a service ticket, and then redirects the browser with that ticket= to bar.com, then when bar.com tries to validate the ticket with validate?service=bar.com the request is rejected because “bar.com” does not match the service ”foo.com” presented when the ticket was issued. The correct way to do this is using CAS Proxy.
From: [email protected] [mailto:[email protected]] On Behalf Of Nate Klingenstein Sent: Monday, March 14, 2016 10:50 AM To: CAS Community <[email protected]> Subject: [cas-user] Ticket Forwarding All, Is there something in the CAS protocol to prevent a client from taking a ticket issued to a user for them and then playing that ticket to another service? Analogous to Audience in SAML land. Thanks in advance, Nate. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/<https://urldefense.proofpoint.com/v2/url?u=https-3A__groups.google.com_a_apereo.org_group_cas-2Duser_&d=AwMFaQ&c=-dg2m7zWuuDZ0MUcV7Sdqw&r=QpF8dn_hVuAkPB3pvSiqWRofnccZc_aZFXs0H7dYvJE&m=bNORfaAhljoWlcwRrcRThc3tDrncJJlIfz1FIblvpcw&s=arZ1BB9W_cdo7rkspkqTI5qYgFsW0t-e_-VWH-x-eP8&e=>. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
