I am using the CAS server overlay from https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.html as SSO and hosting it on a WildFly AS, alongside a JSF application (referred as MyApp).

The problem: When any page of my JSF app is loaded, it sets a JSESSIONID cookie on the / path. When I load the authentication form from the /cas context, another cookie is being set by CAS, with the same name (JSESSIONID) but on the /cas path as expected.

The problem is that when I submit the auth form, the CAS server doesn't execute the request to generate a service token. I will not work until I would have had manually deleted the JSESSIONID from the / path (set by the JSF app) and the CAS form is submitted with just 1 cookie (the JSESSIONID from the /cas path).

How do you deal with such a scenario? Is it acceptable to force the CAS app to reuse the JSESSIONID from the root path / instead of creating it's own on /cas path? (how could this be done)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.