Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

There was an interesting post about making CAS ticket granting tickets self-validating as an approach to load balancing CAS. This page is for collecting thoughts about this idea.

The idea

In short, the idea is: "the TGC delivered to the client is no longer a truly random string; instead, it contains encrypted details of the ticket which can be used to validate it in the absence of a cache entry".

Rather than using ticket granting cookies that are nothing more than large random numbers, and so are meaningless to anyone other than the CAS server that issued them, instead CAS server would issue ticket granting cookies that are an encryption of the username with a private key shared across the CAS server instances in the load balanced set.

This means that when the user comes back to CAS, any of the CAS servers in the set can recognize the ticket granting cookie and whom it authenticates.

The idea is intended to reduce the need for state sharing across load balanced CAS instances.

Issues