help-may be a stupid question

[qingzhao zheng]

 I have two simple test applications which are casenable.and they don't have authority mechanism.
when I use IE browser. I visit app1 in IE browser window1,then I open a new browser window to visit app2,it ask me to enter
username/password again. If I visit app1 and app2 in the same browser window ,I only need to enter username/password once.
when I add a link to app2 in the app1 page,when I click the link ,although it open up a new window to show app2,it doesn't ask
me to enter username/password again.
Why?
Comparing to IE,when I use Mozilla Firefox brower.No matter I visit the two apps in the same window or in two different browser
windows ,I only need to enter username/password once.
it confusing me.Does it because cas use session mechanism(I must not sure cas use cookie or session)? and the above tow browsers have

different implementation to support
session?Is cas designed to let a user  access to all casenable applications if the applicaions themself don't have authority mechanism?

can anyone  explain it to me? thank you.
                                                 qingzhao

---

雅虎邮箱，您的终生邮箱！
_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[Stefan Dürr]

hi,
you get 2 cookies. one with jsessionid from tomcat(this one is not
really important for cas) and one TGT-Cookie from CAS. If you log in the
you will get a TGT-Cookie from CAS. If you contact your CAS-Server
later, the he will search for this cookie. If it exists and if it is not
expired, then he recognizes you (your browser) as a logged-in user.
For better understanding try this: Open App1 -> log in -> delete the
cookies which you got from the CAS-Server -> open App2
If you do this, then you should not get access to App2, because you have
delete the TGT-Cookie

regards, stefan


qingzhao zheng schrieb:

> I have two simple test applications which are casenable.and they don't
> have authority mechanism.
> when I use IE browser. I visit app1 in IE browser window1,then I open
> a new browser window to visit app2,it ask me to enter
> username/password again. If I visit app1 and app2 in the same browser
> window ,I only need to enter username/password once.
> when I add a link to app2 in the app1 page,when I click the link
> ,although it open up a new window to show app2,it doesn't ask
> me to enter username/password again.
> Why?
> Comparing to IE,when I use Mozilla Firefox brower.No matter I visit
> the two apps in the same window or in two different browser
> windows ,I only need to enter username/password once.
> it confusing me.Does it because cas use session mechanism(I must not
> sure cas use cookie or session)? and the above tow browsers have
> different implementation to support
> session?Is cas designed to let a user access to all casenable
> applications if the applicaions themself don't have authority mechanism?
> can anyone explain it to me? thank you.
> qingzhao
>
> ------------------------------------------------------------------------
> 雅虎邮箱，您的终生邮箱！ <http://cn.mail.yahoo.com/>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Yale CAS mailing list
> cas@...
> http://tp.its.yale.edu/mailman/listinfo/cas
>  

_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[scott_battaglia]

For IE, it depends on how you open the windows on whether they share their cookie state or not.  Its a known IE issue.

-Scott

-Scott Battaglia
PGP Public Key Id: 0x383733AA
LinkedIn: http://www.linkedin.com/in/scottbattaglia

On Wed, Jun 25, 2008 at 10:34 AM, qingzhao zheng <qingzhaoz@...> wrote:

 I have two simple test applications which are casenable.and they don't have authority mechanism.
when I use IE browser. I visit app1 in IE browser window1,then I open a new browser window to visit app2,it ask me to enter
username/password again. If I visit app1 and app2 in the same browser window ,I only need to enter username/password once.
when I add a link to app2 in the app1 page,when I click the link ,although it open up a new window to show app2,it doesn't ask
me to enter username/password again.
Why?
Comparing to IE,when I use Mozilla Firefox brower.No matter I visit the two apps in the same window or in two different browser
windows ,I only need to enter username/password once.
it confusing me.Does it because cas use session mechanism(I must not sure cas use cookie or session)? and the above tow browsers have

different implementation to support
session?Is cas designed to let a user  access to all casenable applications if the applicaions themself don't have authority mechanism?

can anyone  explain it to me? thank you.
                                                 qingzhao

---

雅虎邮箱，您的终生邮箱！
_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[Tim Mc Laughlin]

To expand on that: when you open your new IE window by choosing File->New Window in your existing IE window, the same cookie store is used for the new IE window.  If you open it any other way (Start Menu, Quick Launch, etc.) the process is separate and you have a new cookie store.

Firefox processes all share the same cookie store, so this is not a problem.

Tim


-----Original Message-----
From: cas-bounces@... [mailto:cas-bounces@...] On Behalf Of Scott Battaglia
Sent: Wednesday, June 25, 2008 8:29 AM
To: Yale CAS mailing list
Subject: Re: help-may be a stupid question

For IE, it depends on how you open the windows on whether they share their cookie state or not.  Its a known IE issue.

-Scott

-Scott Battaglia
PGP Public Key Id: 0x383733AA
LinkedIn: http://www.linkedin.com/in/scottbattaglia 


On Wed, Jun 25, 2008 at 10:34 AM, qingzhao zheng <qingzhaoz@...> wrote:


         I have two simple test applications which are casenable.and they don't have authority mechanism.
        when I use IE browser. I visit app1 in IE browser window1,then I open a new browser window to visit app2,it ask me to enter
        username/password again. If I visit app1 and app2 in the same browser window ,I only need to enter username/password once.
        when I add a link to app2 in the app1 page,when I click the link ,although it open up a new window to show app2,it doesn't ask
        me to enter username/password again.
        Why?
        Comparing to IE,when I use Mozilla Firefox brower.No matter I visit the two apps in the same window or in two different browser
        windows ,I only need to enter username/password once.
        it confusing me.Does it because cas use session mechanism(I must not sure cas use cookie or session)? and the above tow browsers have
        different implementation to support
        session?Is cas designed to let a user  access to all casenable applications if the applicaions themself don't have authority mechanism?
        can anyone  explain it to me? thank you.
                                                         qingzhao

       

________________________________

        雅虎邮箱，您的终生邮箱！ <http://cn.mail.yahoo.com/>
        _______________________________________________
        Yale CAS mailing list
        cas@...
        http://tp.its.yale.edu/mailman/listinfo/cas
       
       




_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[qingzhao zheng]

Hi,stefan In order to test where can I find the TGT-cookie?

 

 

 

 

 

                                                   qingzhao

                                                                

---

雅虎邮箱，您的终生邮箱！
_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[Stefan Dürr]

I do not know how it is in IE, but in Firefox2 you see the cookie here:
extras->einstellungen(settings?)->Datenschutz(data security?)->Cookies
anzeigen(show cookies)
then select the url, where your cas-server is and then you should see a
cookie with the name "castgc" which contains tht tgt. this is the one
cas creates after your login

regards, stefan


qingzhao zheng schrieb:

> Hi,stefan In order to test where can I find the TGT-cookie?
> qingzhao
>
> ------------------------------------------------------------------------
> 雅虎邮箱，您的终生邮箱！ <http://cn.mail.yahoo.com/>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Yale CAS mailing list
> cas@...
> http://tp.its.yale.edu/mailman/listinfo/cas
>  

_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[qingzhao zheng]

Thank you ,Tim and stefan.I have found the cookie in the firefox.Tim you're right .but in the directory \Local Settings\Temporary Internet Files and  \Cookies I still can't find the tgt cookie stored by IE.where is it?

                                                                         qingzhao

---

雅虎邮箱，您的终生邮箱！
_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

[scott_battaglia]

Its probably not stored since its an "in-memory" cookie only.  That's just a guess though.

-Scott

-Scott Battaglia
PGP Public Key Id: 0x383733AA
LinkedIn: http://www.linkedin.com/in/scottbattaglia

2008/6/27 qingzhao zheng <qingzhaoz@...>:

Thank you ,Tim and stefan.I have found the cookie in the firefox.Tim you're right .but in the directory \Local Settings\Temporary Internet Files and  \Cookies I still can't find the tgt cookie stored by IE.where is it?

                                                                         qingzhao

---

雅虎邮箱，您的终生邮箱！
_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas

_______________________________________________
Yale CAS mailing list
cas@...
http://tp.its.yale.edu/mailman/listinfo/cas