...
The CAS filter is the simplest way of CAS-protecting your Java Servlets application.
Configuring CASFilter
Just a few lines of XML need to be added to your web application's deployment descriptor (web.xml):
...
init-param name | usage |
|---|---|
edu.yale.its.tp.cas.client.filter.serviceUrl | this parameter replaces the serverName parameter above. It becomes the URL that CAS redirects to after login. If you have one specific point of entry to your web application and you want all logins to proceed through that page, you would specify the full URL of that page here. |
edu.yale.its.tp.cas.client.filter.authorizedProxy | to allow the filter to accept proxy tickets, you need to specify valid proxies through which the authorization must have proceeded. This initialization parameter accepts a whitespace-delimited list of valid proxy URLs. Only one URL needs to match for the login to be successful. Note that if you do want to accept proxy tickets, you will have to change the validateUrl above to proxyValidate rather than serviceValidate |
edu.yale.its.tp.cas.client.filter.renew | if set to the string, true, this is the equivalent of authenticating a ticket with renew=true passed as a parameter. This may be used for high-security applications where the user must enter his/her credentials again before accessing the filtered URLs. |
edu.yale.its.tp.cas.client.filter.wrapRequest | if set to the string "true" the CASFilter will wrap the request such that calls to getRemoteUser() return the authenticated username. |
Consuming the results of CASFilter
Once the user has logged into your application through the filter, the application may access the user's name through the session attribute, edu.yale.its.tp.cas.client.filter.user, or if you import edu.yale.its.tp.cas.client.filter.CASFilter in your JSP or servlet, simply CASFilter.CAS_FILTER_USER.
...
| Code Block |
|---|
// either of these will work:
session.getAttribute(CASFilter.CAS_FILTER_RECEIPT);
session.getAttribute("edu.yale.its.tp.cas.client.filter.receipt");
|
Session attributes set by CASFilter
Session attribute | usage |
|---|---|
edu.yale.its.tp.cas.client.filter.user | String represented the authenticated NetID |
edu.yale.its.tp.cas.client.filter.receipt | CASReceipt representing the results of CAS authentication. Use this object to programmatically access the proxy chain, whether the authentication was required to have been by presentation of primary credentials, etc. |
Read more about CAS Filter behavior.