Spring Security - Third Edition

Proxy ticket authentication for stateless services

Centralizing our authentication using CAS seems to work rather well for web applications, but what if we want to call a web service using CAS? In order to support this, CAS has a notion of proxy tickets (PT). The following is a diagram of how it works:

The flow is the same as standard CAS authentication until the following things take place:

1. The Service Ticket is validated when an additional parameter is included called the proxy ticket callback URL (PGT URL).
2. The CAS Server calls the PGT URL over HTTPS to validate that the PGT URL is what it claims to be. Like most of CAS, this is done by ...