I am using the CAS server overlay from https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.html as SSO and hosting it on a WildFly AS, alongside a JSF application (referred as MyApp).
The problem: When any page of my JSF app is loaded, it sets a JSESSIONID cookie on the / path. When I load the authentication form from the /cas context, another cookie is being set by CAS, with the same name (JSESSIONID) but on the /cas path as expected.
The problem is that when I submit the auth form, the CAS server doesn't execute the request to generate a service token. I will not work until I would have had manually deleted the JSESSIONID from the / path (set by the JSF app) and the CAS form is submitted with just 1 cookie (the JSESSIONID from the /cas path).
How do you deal with such a scenario? Is it acceptable to force the CAS app to reuse the JSESSIONID from the root path / instead of creating it's own on /cas path? (how could this be done)