Proxying a CAS Service with CASClient and Sinatra - ruby

Question

my first question at SO, hope I can get any help.
The architecture of the problem is: I have a simple webapp sourced by Sinatra and Slim, and using SSO CAS System for Authentication. Importand detail: Not using Rails.
The CAS filter is done by hand like this:
class App < Sinatra::Application
before do
process_cas_login(request, session)
require_authorization(request, session) unless logged_in?(request, session) end
And the CAS methods do something like this:
def process_cas_login(request, session)
if request[:ticket] && request[:ticket] != session[:ticket]
service_url = read_service_url(request)
st = read_ticket(request[:ticket], service_url)
CAS_CLIENT.validate_service_ticket(st)
if st.success
session[:cas_ticket] = st.ticket
session[:cas_user] = st.user
else
redirect '/'
#raise "Service Ticket validation failed! #{st.failure_code} - #{st.failure_message}"
end
end
end
def logged_in?(request, session)
session[:cas_ticket] && !session[:cas_ticket].empty? end
def require_authorization(request, session)
if !logged_in?(request, session)
service_url = read_service_url(request)
url = CAS_CLIENT.add_service_to_login_url(service_url)
redirect url
end end
The problem is: My backend needs to invoke a REST service from other Sinatra application and mantain the session (ask for a ticket, know the user that invoked that service, stuff like that)
I was reading about Proxying but I couldn't make that happen in my current model, do you have any clues?
There is a walkthrough with Rails filters, but again, I am not using Rails.
Thank you on advance for your help

Answer 1

In your app, instead of calling the service validate url, you need to call the proxy validate url of the CAS server (/proxyValidate) with your current ticket, the service and a pgtUrl parameter.
In the returned XML, you will get a new cas:proxyGrantingTicket tag containing the PGTIOU: it must be stored in a shared map in your app: pgtIou <-> user_identity
This pgtUrl is an url in your application which will receives callbacks from the CAS server with two parameters: pgtIou and pgtId. Using the previous shared map, you know have: pgtId <-> user_identity.
For a user identity, if you want to call a REST service, you need to obtain a ticket for it by calling the /proxy url of the CAS server giving the pgt parameter (the pgtId) and a targetService parameter for the REST service.
Finally, you just need to call your REST service like any CAS service by providing a service ticket. This REST service must protected by the CAS server of course and will in turn perform a service ticket validation via the CAS server.