title: Spring and CAS using Proxy Tickets
body: <p>I have two web applications, Webapp A and webapp B. Webapp A is Spring 3.1 webapp. Webapp B is separate non-spring webapp. Both are protected by CAS. My goal is to allow webapp A to use a proxy ticket to retrieve information from webapp B.</p>
  
  <p>To simplify things I've taken the cas-sample provided by spring-security to be webapp A. The default sample configured to use my local cas works as expected. For those unfamiliar with the cas-sample, it provides an example that uses a proxy ticket to request another page within the cas-sample application. I then use a simple page under an apache webserver protected using mod_auth_cas for webapp B. Again, webapp B works as expected. When I change the cas-sample to request webappB using a proxy ticket it does not work. The response from the request for webappB is the CAS login page. Note: I've tried an tomcat webapp (non-spring) for webapp B, with same result. Which leads me to believe the problem is not in webapp B. Below is the code used to make the request to webapp B using the proxy ticket. And the security context configuration can be viewed <a href="https://fisheye.springsource.org/browse/spring-security/samples/cas/sample/src/main/webapp/WEB-INF/applicationContext-security.xml?r=11dc3363cc57433e0583c01304232bb8a6c5c45c" rel="nofollow">here</a>.</p>
  
  <pre><code>final String targetUrl = "https://server/webappB";
  final CasAuthenticationToken token = (CasAuthenticationToken) request.getUserPrincipal();
  final String proxyTicket = token.getAssertion().getPrincipal().getProxyTicketFor(targetUrl);
  final String serviceUrl = targetUrl+"?ticket="+URLEncoder.encode(proxyTicket, "UTF-8");
  String proxyResponse = CommonUtils.getResponseFromServer(serviceUrl, "UTF-8");
  </code></pre>
  
  <p>What am I doing wrong? Why would this work when the above targetUrl is within webapp A but not an external application?</p>
  
  <p>Thanks for any help.</p>
  
  <p><strong>EDIT</strong>: If it helps here is what appears in the CAS log when a request is made to the webapp A page that uses the proxy ticket.</p>
  
  <pre><code>[org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Attempting to retrieve ticket [TGT-2-YX0RNVRDHAPyGLy6ymGGVucUSQyjtre4jvGrAxYk2hXsehsxqx-cas]
  [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Ticket [TGT-2-YX0RNVRDHAPyGLy6ymGGVucUSQyjtre4jvGrAxYk2hXsehsxqx-cas] found in registry.
  [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Added ticket [ST-3-JrQKqqpZJz00a2hsGZP6-cas] to registry.
  [org.jasig.cas.CentralAuthenticationServiceImpl] - Granted proxy ticket [ST-3-JrQKqqpZJz00a2hsGZP6-cas] for service [https://server/webappB] for user [testUser]
  [org.jasig.cas.web.support.CasArgumentExtractor] - Extractor generated service for: https://server/webappB
  [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Attempting to retrieve ticket [ST-3-JrQKqqpZJz00a2hsGZP6-cas]
  [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Ticket [ST-3-JrQKqqpZJz00a2hsGZP6-cas] found in registry.
  [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Removing ticket [ST-3-JrQKqqpZJz00a2hsGZP6-cas] from registry
  [org.jasig.cas.web.support.CasArgumentExtractor] - Extractor generated service for: https://server/webappB
  [org.jasig.cas.web.flow.InitialFlowSetupAction] - Placing service in FlowScope: https://server/webappB
  [org.jasig.cas.web.flow.InitialFlowSetupAction] - Placing service in FlowScope: https://server/webappB
  [org.jasig.cas.web.support.CasArgumentExtractor] - Extractor generated service for: https://server/webappB
  </code></pre>