Description
Gustavo Fernandes(Migrated from SEC-348) said:
I am using CAS provider with a httpinvoker based swing client, that sends _cas_stateless as
username and a ST as password (obtained directly from CAS). In the server side I use
two filters: httpsessionintegrationFilter and basicProcessingFilter.
In the first time the basicProcessingFilter validates the ticket against CAS, and the
sessionIntegration filter puts the autentication in the session, as desired.
The next time, the client sends the same jsessionId, the httpsessionintegrationfilter
corretly extracts the context from the previously created session but basic processing
filter tries to autenticate again (validade CAS ST AGAIN).
The line 138 of the class BasicProcessingFilter, it checks if it need to reauthenticate
by checking (among other things) if the existingAuth´s username (obtained from session) is
equals to the username that came from the HTTP Header. If they are not equal, the filter tries
to reauthenticate. Since http header´s username is always equals to “cas_stateless” and
existingAuth´s username is equals to the auhtenticated user, they are never the same, and the
basicprocessingfilter will try to validade the ticket again. The correct behaviour would be
to just revalidate the ticket when the session does not carry a valid authentication anymore.