Jasig/cas — pull request #780 by astik (2014-11-27 17:41:42+00:00)
Title: 3.5.2.1 cookie lookup while retrieving TGT-id

Here is a simple change to check the cookie while retrieving the TGT-Id ; before that, TGT-Id was only retrieved from the {ticketGrantingTicketId} mapping (/v1/tickets/{ticketGrantingTicketId}).

This change answers this matter :
- John is connecting to an application A. Very classic CAS application, John is redirected to CAS, authentifies, gets a TG Cookie, is redirected back to his application with a ST which is validated between Application A and CAS : John is authentified on application A and has a TGCookie on CAS domain.
- John go to a page on application A that use a webservice W on the front side. W is also protected by CAS. John needs a ST to get to webservice W.
- we don't want John to authenticate himself on the CAS REST API as we don't have its credential. Also, we don't want to ask John for his credential once again (this time through Application A and not through CAS)

Webservice W is called from Application A's domain through AJAX with CORS enable. To get a new ST to reach webservice W, we need to call CAS with AJAX (/v1/tickets/xxxx), but we don't have the TGT-Id information (the xxxx part of the URL). What we know is that John is authenticated on CAS and have a TGCookie on CAS domain. So that, we will enable this cookie to be send with the AJAX request on CAS (with the withCredentials feature : http://quickleft.com/blog/cookies-with-my-cors). That way, the TGT-id will be send to CAS and we can get the ST without having access to credentials on application A's domain.

Of course, we can turn our architecture to Oauth ... but it is way less easy to set up than a classic CAS server.