lifton/rubycas-server — pull request #5 by ccaum (2012-09-20 22:45:52+00:00)
Title: Use a defined session key

Previous to this commit, it was not possible to invalidate user logins
since setting a new session secret in Console Auth did not invalidate
the 'tgt' cookie in RubyCAS Server. This meant the rack sessions for all
applications using Console Auth were indeed invalidated, but when
redirected to CAS for authentication, CAS used the user's still valid
Ticket Granting Ticket to authenticate the user and issue a new Service
Ticket for the requesting application. The end result is the appearance
that the user's original login was never invalidated.

This commit modifies the RubyCAS server to use a defined session secret
for its tgt cookie. When this session secret is changed, all 'tgt'
cookies are invalidated and therefor all single sign on logins are
invalidated. Note the session key MUST be changed in coordination with
Console Auth's session key in order for all current application logins
to be invalidated.