Setting aside the question of whether this is a good idea and answering the literal question of why it doesn’t work, the CAS login is coded in Spring Webflow. There is an initialization step and then a sequence of test (like is the user already logged in with a CASTGC cookie, and only after that is the form displayed and then the response is processed. The flow maintains state for a “conversation” that begins at initialization, and you cannot jump into the middle of the flow and respond to a form that was never sent to you because, among other things, the service=xxxx value is stored in the conversation state and cannot be submitted with the form. When the Flow discovers there is no saved state, it starts over again at the beginning.
You would have to recode the entire WebFlow to allow a “naked” POST (or in this case a naked GET). We did this, but not for the reason you give. For some undisclosed reason that we were never able to debug, a few times a day a random person would lose his or her conversation state (not for the obvious reason that it timed out) and would complain that they had to submit their userid/password twice to login to CAS. Since we could not get whatever network or HTTPS problem to go away, we recoded the Flow so if you came to the start of the flow with a POST instead of a GET it would fix everything up and then jump to the middle state in the flow that handles form submission. To do this, you have to add a hidden input field with the service= value. I do not recommend doing all this work, but as a result I can explain what is the cause of the restriction you encounter. From: [email protected] [mailto:[email protected]] On Behalf Of Richard Yang Sent: Thursday, February 2, 2017 3:47 PM To: CAS Community <[email protected]> Subject: [cas-user] why /cas/login?username=xxx&password=yyyy does not work? I am using cas 4.2.7 http://localhost/cas/login?username=xxx&password=yyyy just gives me the default cas login page. I understand I may need to attache a "login ticket" if not submitting a login form, but how to get a login ticket? The reason I want to use the cas login api in http request is to integrate cas sso with our existing login page. Please do not tell me I can custom my current login page with cas's jsp form based login. It is just too much work and jsp to us is a very old technology and not to be considered for new development. Thanks. Richard -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CY4PR08MB2949EFE56F82060036BF789CFB4F0%40CY4PR08MB2949.namprd08.prod.outlook.com.
