> I’d expect to be able to put what was received from the rest endpoints (the > TGT) > in a cookie and be authenticated. Obviously, I’m wrong.
If I am reading things right, this bit is key. When you handle and do things with REST, you're "on your own". You're responsible for cookies (or not) if you wish to manage the SSO session. It's up to you, because you're handed the TGT and you get to decide what to do with it. You are the CAS server, essentially. If you want the CAS server to be a CAS server handling sso then you need to find a different authentication mode. REST won't do. With this, it's just brokering authentication. You will also need to look into logs to figure out what happens to that ticket. Needless to say, you can only validate it once, and you cant pass it onto something else. For that you need proxy tickets. -- --Misagh -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2135284935.4347486.1503592845208.JavaMail.zimbra%40unicon.net.
