Conversation
Previous to this commit, there was no way to specify specific URLs or URL patterns that will be except from requiring authentication. This commit introduces a configuration parameter, :allow_unauthenticated_urls, that can be an array of regular expressions or strings that will be used to match the requesting URL. If the requesting URL matches any of the exceptions given, the request will be allowed through.
|
Sorry about all the trailing whitespace removal. My text editor does that automatically. |
|
This is a useful feature; most cas client have it. |
Previous to this commit, the PATH_INFO header information was used to determine the calling page. This however doesn't always give the exptected result. For example, for rack applications launched by passenger using RackBaseURI, the path to the rack application is stripped from PATH_INFO. This commit uses the REQUEST_URI to resolve the issue
|
After some more testing, this simply doesn't work. The problem is that if the service doesn't have a service ticket yet, it needs to be redirected to CAS to get one. The means there is no way to test if the session is unauthenticated, but allowed anyway. Can anyone think of a way to allow users with a valid TGT to continue on as usual but allow unauthenticated requests to pass through? |
Previous to this commit, requests that matched an exception would be passed through without the CAS rack session data being created regardless of whether the request is authenticated. This commit only tests unauthenticated requests if an exception should be allowed through
|
I took the best stab at it I could. If there is a valid service ticket, we'll treat it as an authenticated session. If there isn't, we'll let the request past through if the URI matches a given exception |
|
+1 |
3 participants
Previous to this commit, there was no way to specify specific URLs or
URL patterns that will be except from requiring authentication. This
commit introduces a configuration parameter,
:allow_unauthenticated_urls, that can be an array of regular expressions
or strings that will be used to match the requesting URL. If the
requesting URL matches any of the exceptions given, the request will be
allowed through.