Our app server can call cas api to create a tgt and then a ticket for a service. We then redirect the browser to the third party application with a redirect url like: https://third_party_url.com/cas?ticket=ST- <https://response-test.assessment.pearson.com/cas?ticket=ST-586-QVMXQEkoQbuwy5IhXFbf-epen_cas&pgtUrl=https://response-test.assessment.pearson.com/images/clip/00000348258009201303/CLASS?mode=dev&secure=1&format=PNG> xxxxxx Assuming the ticket is valid and never used. Is above url is good enough, even I don't have cas cookie stored in the browser because we never login to cas through login form? Does the third party third_party_url.com <https://response-test.assessment.pearson.com/cas?ticket=ST-586-QVMXQEkoQbuwy5IhXFbf-epen_cas&pgtUrl=https://response-test.assessment.pearson.com/images/clip/00000348258009201303/CLASS?mode=dev&secure=1&format=PNG> needs to write special code to parser the ticket and then forward to cas? Or it is automatically forward to cas? Does cas first check if the ticket parameter exists before check if the cas cookie exists?
By reading this link https://www.purdue.edu/apps/account/html/cas_presentation_20110407.pdf It seems as long as the ticket parameter exists in the url, cas cookie is not needed. Is my understanding correct? Thanks. Richard -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/bf9fe991-398d-4741-b8bf-e59abb966d10%40apereo.org.
