Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Next »

What is

The main MODEL (hierarchy of different Ticket types) is in "ticket" package. So a separate class diagram of this MODEL would be useful. In addition to the core MODEL there are supporting service layer interfaces in the "ticket" package e.g. TicketManager (the main facade into the ticket MODEL), TicketRegistry (internal ticket cache), TicketFactory (internal factory for vending tickets), TicketCreator (TicketFactory's helper interface for instantiating a particular type of a Ticket), ExpirationPolicy (Ticket's strategy collaborator to define different expiration policies for tickets), etc., etc.

Ideas

Server-side, we can simplify the set of Ticket types we need to model.

There are really only two kinds of tickets. There are GrantingTickets, and there are ServiceTickets. Each of these are a type of (extend) Ticket.

Tickets have two properties. They have a "grantor" property, that is either null or the GrantingTicket that granted them. They also have a String identifier which uniquely identifies the ticket from a large namespace. Part of the identifier is drawn from a large space uniformly at random. This is key to CAS's security.

GrantingTickets add to Ticket an additional property: the immediate authenticated Principal to which the GrantingTicket was issued. This might be a user Principal, in the case of the GrantingTicket that is stored into a secure cookie in a user's web browser, or this might be a service Principal, in the case of a GrantingTicket that was issued by secure callback to an application or to an otherwise authenticated application out there on the Internet.

ServiceTickets add to Ticket an additional property: the Target to which the ServiceTicket is intended to authenticate.

It's turtles all the way down.

  • No labels