Hi everyone, I'm trying to create a form where users can authenticate to CAS. The problem is, this form lives on a different domain from the CAS server; the CAS server is on one subdomain of our site and the form is on another subdomain. I'm aware that it's typically not recommended for non-CAS applications to accept credentials, but I've been asked to prepare a remote login form with the intention that the remote form would actually be what users see almost every time.
A search of Google shows that I can either disable CAS sessions, or I can request the login page behind the scenes and parse out the login token. I've chosen the latter approach, but I seem to be hitting a snag. When I load the page with my form, I can see that the hidden input (which I named "lt") has what appears to be a CAS login token as its value. When I enter credentials and click my submit button, I can use Firebug to see that my username/password, the login token, and the _eventId paramater (set to "submit") are sent as POST parameters. The service URL is part of the URL I send the POST request to; the form's action is "https://cas.server/cas/login?service=https%3A%2F%2Fservice%2Fpath";. The only restrictions that come to mind are that we're using CAS 3.3.5 and for the moment cannot upgrade. ClearPass 1.0.6GA has some fixes we really need, so we're trying to get approval to upgrade, but for now we need to assume that we're stuck on CAS 3.3.5 for the next little while. Also, we cannot modify the CAS server code. I saw one solution that required some CAS server changes, which we can't do. Any suggestions on what I've missed, pointers to documentation I should read or nudges in the right direction would be greatly appreciated. -- Joel Goguen System Administrator/Web Developer Enterprise Solutions Integrated Technology Services University of New Brunswick E-mail: jgog...@unb.ca Phone: (506) 453-4872 Fax: (506) 453-3590 There's no place like 127.0.0.1 -- You are currently subscribed to cas-dev@lists.jasig.org as: arch...@mail-archive.com To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
