lifton/rubycas-server — pull request #4 by ccaum (2012-09-20 19:47:18+00:00)
Title: Use Console Auth's cookie session secret

Previous to this commit, it was not possible to invalidate user logins
since setting a new session secret in Console Auth did not invalidate
the cookies in RubyCAS Server. This meant the rack sessions for all
applications using Console Auth were indeed invalidated, but when
redirected to CAS for authentication, CAS used the user's still valid
Ticket Granting Ticket to authenticate the user and issue a new Service
Ticket for the requesting application. The end result is the appearance
that the user's original login was never invalidated.

This commit modifies the RubyCAS server to use the same session secret
for its tgt cookie as Console Auth. When the session secret is changed
in Console Auth, it is therefor changed in CAS, invalidating all
logins to all Console Auth supported applications.