title: How to authenticate two clients at once with JASIG SSO
body: <p>Honestly not sure if the title is descriptive enough, so here goes the text:</p>
  
  <p><strong>Backstory</strong></p>
  
  <p>I am rebuilding a web application using the Spring framework. However, the old application runs on PHP.</p>
  
  <p>There's a grace period where both of the applications will be running at once, so i'll be moving stuff over slowly to the java side and away from PHP.</p>
  
  <p>Luckily for myself, most of the communication between back and frontend has been done trough jQuery and AJAX.
  I've already setup a host of rest endpoints to take care of reading, and saving was next on my list.</p>
  
  <p><strong>The problem</strong></p>
  
  <p>Now the problem arises that my Spring application needs to know if the user that is logged in is actually allowed to save data.
  A coworker proposed i used Jasig CAS SSO as an authentication, so that the php and java application will both use the same login.</p>
  
  <p>However herein lies a problem as well. I have setup spring security to work with the SSO, and also PHP knows how to behave with it. However, the problem comes when i do an AJAX request to the Spring side. Spring security detects that i'm not logged in (possibly because there are no cookies being sent) and thus returns a 302 for me to go to the CAS login page.</p>
  
  <p>I've managed to get everything running on the same (not outward facing) domain:</p>
  
  <ul>
  <li>cas.domain.local</li>
  <li>app.domain.local (PHP)</li>
  <li>tools.domain.local (Java)</li>
  </ul>
  
  <p>The requests are coming from app.domain.local to tools.domain.local</p>
  
  <p>I've read a lot about Ticket granting cookies, ticket granting tickets, sending session information in my ajax request, but also of something called an authentication proxy.</p>
  
  <p><strong>The question</strong></p>
  
  <p>What would be my best method of telling the java side, trough an ajax request that i'm already authenticated with the cas SSO server?</p>
  
  <p>Please ask if more information is required. This is my first stackoverflow question and i don't quite know how to word everything.</p>