yet at the meeting . How CAS . longer than I have . Danielle . the Mets read any of that . so . of was yelling his edit the cost will be three to the Interfax and easy as lot of Syria . and that they think . Define has put all of their helpful certainly reserve time that the and to discuss it and we can all agree that that its orbit bad idea no one should ever do it in the making debaters today . well be almost meant that point . . and of course the . he said . absolutely . begin think this is recording of the credit . this is roughly what we're going talk about on to what ClearPass is How It Works wide exists . couple of examples of how it can be used . Thompson big thoughts about where it's going in the future and then discussion and questions . . so the is ClearPass anyway . CAS Use Spring open source software that Extends has to not capture the and users of password . against the on fill out the login form . and the selectively released that password to authorized applications what sort of authorized application's Well for instance in an enterprise portal might be a good application to release this to . . we has come from . which determines when it's . this is about the unit on four Sacramento State University . and then released in collaboration with sex data is as freedom source software is a as a contribution to JC Extension Dick as and you portal . and then there's no recently been updated by Scott is a way of actually Who's these hearings is the session . on the upper third of respondents even come Support Program . so we heard from our keynote speaker . yesterday some thoughts about and support and maintenance of open source software . and in ClearPass in we have a small tube in yet . I love how that can work . . . that was in this was nice to the country we do what is it on the streets after Extensions to chasing CAS introducing new portal on to have these two behaviors to be the two pieces of this interaction . it's an extension . take as its actual source code and suffering can install that that Golan was on the year has server Intuit is a parasite to capture him Expose those credentials . and that Extensions do you portal to consume the new services that are Expose out of CAS . and and the actual source code and eighteen Source control and that's where it is in fact in source control . there's also some weakness based in the week as Manual and and your eighty she tracker we can go raise issues about that . and so . . and so . a way a way time out there seems to be some issues here . did UI say that this is an extension to release the end user's password . that doesn't sound like a very good idea maybe we need that kind of time out to think about this idea . we want to do that . the skepticism is warranted . . passwords are searching the money they're just such useful things and include them to also to things . and up . when this river has ever did in the password to many one . OK not that you're Institutional password crucial we'd never do that because your book reviews policies as well be that to no one's ever done that of course . any other password . in your life you've given them to children and spouses and friends and co-workers and colleagues in the mid exists a useful all convenient things . . runner releases passwords . well for two particular purposes home on one hand to accomplish . and user single sign on the and applications . and on the other hand to do this contains your applications application authenticates . the solutions to I . you gave your password to your friends relatives colleagues and smallpox which because it is convenient for them to . login to applications directly warned to on your behalf code get some information . honey to do pleased with the park thinking tell balance and picture this Check am about to write is imbalance . the country here's an example where you didn't credentials to someone else . so that they can check something for you . and then reported back to you . . Separate as the the promise was that really get rid of all these drug in forms and instead uses some sort Annotation use has to like the and application to the slide looks familiar it should insist directly from them materials we would all but has and this is what you do . and the of course is that all these applications are not going to touch passwords and said Well are you status . two . do log ins applications . the problem is that sometimes this conversion from a . presiding light using in password to particular application experience . and getting that to use CAS authenticates and despite all the great work it's got to take we and others have done on CAS client library is the fact that you can use Container medication while the beautiful Tennessee of integration work despite all about This is still greater than zero . after . and sometimes that amount greater than zero . he is traded . sometimes you have applications that are proprietary that you have difficulty Modify and perhaps that you have difficult . difficulty cassified . . this is one reason we might want to do ClearPass says if we can figure out how to testify that they were stopped with a user name password login experience and what we need is to shake re that password so that we can put in this warming log the user in because User doesn't mind here about how hard it is to cassified something like Alec Web Access with a one of use experience convenient . single sign . . the reason that we might want to trade treaties passwords and the avoids Replace of use for this and you're authenticates prompting the problem in general is the user authenticates to some application like San enterprise portal and that application that authenticates to some other application or service . on behalf of the user in the service of the . and then somehow to the college this general problem . and there are no really rigorous Principle ways to do this with Delegated cell assertions with our imports each has on certain leaders other means to accomplish application to application of dedication you can use client services the certificate seeking his shared secrets . even so the Trust an application just a server . user's identity . we do this is this direct use of an user credentials . Cotter I know that . you are coming in the name of Scott it anyway we had is password and most of guidance Some now . . they can password reset use trains and a new step in . but Allows example is when the social networking websites for sharing everything old is information about your travel . this turns out to be pretty convenient for gathering together your itinerary and flights and so forth in sharing it with all your friends so they can see way can be when you're coming . . we had our connections with one convenient thing to do is you can go look at gene a look at every Email you've ever sent and determine that those people are all your friends . and ahead admin this connections Facebook does this it seems like every Does this . a bad idea . yet password reset useful for . . the in the consumer grade . . software in the cloud kind of services that are really exciting Like trip and Facebook and so forth . this is also quite close to home in thing is we do in JC the and say you portail others a you know portlet on a Duke or instance at one of things you can do this add up all the counts that you'd like to preview the email I fear I have coming up but forum telling it . my g mail password . because these password reset useful things . . after all why is this application . . the cassified . using the user name and password . as the leading operation . to determine if it's OK to show you during the . is it to the US to the story Email Singh the your e-mail . . . what do and talking about why we need ClearPass . we need ClearPass for some and Implementations of this and user single sign on experience . forum in go ahead and fill out a form like that for them . and we knew for some Implementations of in and see are your applications application on behalf of the user experience where I need an application to go do something with some other application or service on my behalf . he needs to authenticates . one . rather badly for it to do that is to have my password presented to the doctors . . why . this class . . well let's talk about Contracts Each as or to already knows how front seat as works . and that unless a Crescent the and those same hands will go up to be be exactly the same . right now we can certainly . find some time in and preferably the reception or something and top Further about how this works . Ameobi said And identified come through . this is how cas works . so the idea is dead . you got your Web browser . the end . you would like to authenticates to some web application that web applications sends you take as open source is that login experience to CAS . so that's is just indication what it is I'm trying to log into . Ben magic happens . I interact with has been the real magic is at the local login form but the point is it can be anything it could be . I can Client side this is all certificates are one time passwords hope in that war . you can just choose to trust everyone away Really unit to show login form on the CAS and log in . so again on trying the new an application based and eighty has . something happens at the end the game form at CAS to log in obscenely it sucks this session cookie so that a single sign on session with CAS . but from purposes that's really not important . and and does Redirect me back to the web application sending this token . call the ticket . web application validates the ticket with ads . Discrete as BC mistake it will Email Yes I just issued that diamond trade . has told the application who it is that a just issued that to get to . and while I I have login the application . without be seeing the and usage password . we did so karma . snow with the intent as works . and you'll see much of this is exactly the same story again on trying to log into an application ago it as for the login experience has Redirect me with that service ticket to the application of the application validates the servers ticket with Kazakh gets back . the net ID . there's some dirty additional details here that of when the gloss over . and the upshot is that the application gets the proxy granting taking take it that it can subsequently use . that's . it's of the application can subsequently present that proxy granting ticket to cas in order to get the proxy take it . for the purpose of the Pennington into some back and application . when the back and application of needs that proxy take a . he gets both denied any the identity of the and user who session we are service and hear the end the identity of the intermediary application of the application that is presenting this proxy ticket to it . just and testing because this is exactly what it needs to determine its behavior . Koizumi and user and who was and is asking on behalf of the and user because I might not what anyone who asks on behalf of the in user . How to stay I might very well versed are not just the official enterprise portal . or whatever that's can be . so far . mostly falling of that . and . . his ads . . that is part of the US is built on . that's makes you styling . proxy CAS . so again . the system Extensions seat as usual . these has Extensions in particular what are they do . well these are Extensions to capture the password that log in to catch that password . and to release the password to authorized applications . so . two witnesses capture Dominion is perhaps slightly too clever to dig and use got but it Weber and minimally invasive . and so on their side . BC I didn't as where we can to populate some edit data about the authenticates in on than if you abuse that ever so slightly . that's a good point to put . the . many and that . seize the password the reason this is an appropriate twenty purposes this is the API did concede user name and password as it's presented . and on can catch it . so there's a implementation of that API that one ready and that catches the past . and so you declare this in your Spring bean Configuration Downey and that is . so there it isn't a it's just a class that impl s API . I It takes a reference to that credentials CAS which happens to be a Each catch back to catch . and what we're doing is rejecting that means to on the Authentication Managers the sub . he seemed doesn't responsible for managing the authenticates the user and this . . Dean is going to catch the credentials is just probing do it at this plugin point that it's available and CAS . the idea is you don't have to mingle your login webflow this is not a user experience consideration this is a doubt inside the guts of has consideration and then this happens to be wasted if so the upshot is . it's a . still it is a parasite that you put into your has Authentication engine that is able a monitor . he's authentic agents to know when they succeed in NOTE The the password that is used to succeed and sticking to that CAS . . can I get away with with my hands that much . this is a great audience . Let's begin to see . that cash user any steps that have to think this very session . Kristol Well talking about Eric on any age Cache and so forth . and the outside use that because this is an extra ball catching library that was not invented by cancer ClearPass or . or anyone else to two in JC on this Cache can be shared . across CAS server instances it can be in memory can be cast out to disk it's nice to Action Now you're in an entire configurable cashing framework . so we could twenty fold does have this in memory CAS . . we thousand password . we've CAS the password . now we need to do something useful with the spouse for besides just condoms or memory . and so that peace is an additional controllers . containing the Spring Web MVC pilots . and up going part of the control will look something like this . he ended . what it's doing is lifting up the user name . using that is the key to look in the credentials CAS to to get to credentials . in to expose those credentials down as a model in Spring Web MVC . and then what we can do with the model . get there . yes . we're on Andy . isn't that wild presented to a JSP that produces markup that looks like that's . so it's an additional endpoint typically slash ClearPass on it as and the response of closing all goes well is that right there . . which warrants outstanding job Bang directly with the inter-bank . Grammer goal would be proud . the combination of an exploration pointed question mark . six citing punctuation . . what we're looking at this light is why is there no in Terre Bang . another Riyadh one don't you can wonder . what . . password and includes access to everyone . it decides to complain about why my show that . the password in the clear . well also the room . not really . because this call by Kuali is access to the age be yes . and the requests to enter medicated . via proxy testing . and once again this is the response that you get . in the way that response is actually generated is of course a JSP beak is going of a reasonable Model new controller architecture here . and so that credentials model that was exposed by the comptroller there it is being . Oakley inside the XML . . and again . used Classroom include serve . certainly the resulting the password in the clear bright . . what makes that potentially okay depending on your preferences and Requirements is the first of the your old access creation . yes . and secondly that the request to it is authentic . . but certainly warranted an in Terre Bang anyway right . . . this point that the request is like eighty . we need to talk briefly about the is this applications . they're not as to releases of them the user's password applications China get their hands on your password . they can just ask you you might release in exchange for candy bar is going study showed that . yes CAS . how are they going to get as he was . so we need authenticates . but . the application that is requesting this of CAS . and that is participating in it as single sign on session associated with that and users . how can we do that . . what we needed . using technology . the a the . applications . and the celebrations up with dissipating in eight as single sign on session for for this user . . yes there was some setting of this is new right here . we're going Uses . has brought tickets and so . this makes the CAS server inside . a client of test . this is way too clever . and so on . inside the crew does Extension Uses de Jason CAS client library itself . to require this authenticates to receive the right to take it to validate it . and did to figure out what it means . and so . . we generally know in Web XML mapping that has client base the rest Filter . happen in the two cases of this . this is that he said . exposes the Medicaid user name as that request regular mode user this is the piece that out actually balanced ticket . he's Details in optically important . of and this is the important part of the Filter that really matters . I need and it's genuinely the JC Java CAS Client . LeBron Filter right here . and it's pointed at the CAS server . and here's the key part stats that I can make that go in there we up on these Allowed proxy chains . this is where I'm specifying what are the services the chains of application typically it's a chain with a link drawn . that are allowing to access this call back and get an user passwords so if you are in this case . should be certainly be a Fiesta by the way . . they can you are . the enterprise medal at the institution perhaps then you write be allowed to come back and get his password you are the Shia in in front of Outlook Web Access to accomplish . that's a sign that maybe you're allowed to call back and certainly to some random other services you are not allowed to call back and get . . which makes the woman to lead this rather trivial . the I was . that's Really aureus to edit or is not a lot of Access Control Downey in the ClearPass controller . because of Annotation Access Control is happening up the and . he . . . Java CAS client library as configured in Web XML . if you like to live feather with that kind of interaction than you should've gone to Scott stop on Spring Security which I think was at least recorded . one . said Jessica here . so there were many treats about . . the so the other twenty Test here is that this is the guy you're and says exactly was to say except . what we've done is it's . speaking form and animation year later more we benefit the back and application here . use a piece of that as itself . and so Unauthorized red application that is trying to get the user's password to do what is useful things are talking about earlier . we've as is presented proxy take it too has ClearPass to get the password . so this is an instance of this architecture . yes . he is . yes teams actually . and what isn't any TGT ClearPass his belt . the identity of that application and the identity of the and user single sign of session that were participating . this happens to be exactly what ClearPass means in uses the identity to go look up the password as CAS uses the . I don't need the be requesting opposition to the access control to say are you allowed to have this password released . so were re using technology an architecture that that was our TV news . for proxy vacation into other . application . . . . . . . I . . extension because that allows you to reuse . same wanted to get close to who might be using taxes other services to get back to chasm get the password from CAS . the story is now ways we can use this . and so when an enterprise like say specifically you portal . this is a feature that actually exist right by what we'll see you portal not with CAS . but with a regular user name password on doing what the and one . he's certainly capable of remembering that password and selectively exposing it to Channels announced was to say Portlets and as a matter all that works . tech was truly contrite off you don't have to do that you shouldn't do it . but the technologies that . Kelley No Updated Diagram purports to Miguel . it didn't . in solo . you've the module for ClearPass it's a Busy slightly more ugly source control URL and I'd emphasize that this is real source code meaning the mellow right now . and this is a plug in for new clues SecurityContext API . Mendez This implementation of API do . well yes . it wasn't for the password testing API in that . when you one last to read you know the user's password . it says yes . what is the password that doesn't pass for the the dot . from ClearPass . so implement it as API . so that when you frustrate you impl it as I get wanted to get the answer ISO yes . this is a SecurityContext bag . the Phils about . so that I can be an environment where I get to the password . happens to come from could last rather than from a login form . he ended the tracks again secured from cad is both of these are available in the trail and both Can you selectively released to them going right to see Portlets the need to replace the password and it a modern Fluid proxy ticket using Portlets that are going access . I CAS protected service . the idea is to be with you these in concert . and that's what that source code right there . dots . . and it's a shockingly small other code because we really does is just implementation of the SecurityContext API . and again a . C feature of the Architectures here use that . are we this Layered senior lose that ClearPass is being used . from the perspective of the poor wasn't exactly is if you were using traditional doesn't citation or traditional user name password capture . . Bennett Well source of the US . and then you is the last word in . how Portlets read the review Calendar Preview I we discussed earlier the Tokyo SSO clear whether to free an open source portlet . on that accomplishes credential Replace Rely uniforms . Rob proxy portlet and the role of these are API see the beauty of the Architectures belt . Tom . to take a stand passwords come through in eight JSON sixteen standard way there's no magic extra code that you need Add these are just User attributes from your portal perspective . . . the school . last . projects use to anyone s . the release to the password to applications not BS . and so . indeed . that is necessary to conclude the password into a login form that we'd and submit to the to tell em adviser Alan Web Access or . they can Application your custom application and certainly not what ClearPass is trying this all ClearPass is the infrastructure that makes the password available for you then to do something with it . that the doing isn't your problem . and of course this ensure code person particular kinds of doing . were they doing is to go get some Email forty who gets in . I tell beans were to present that JavaScript it stops the end user's browser through login form when to use it is a sheet and basic authenticates and you know what proxy portlet . and so forth . . I guess that architecture when the new quotas password was just after New do . so it's it's only a special in the attribute that you don't want to make available to all of your Portlets because most of them should not needed . so this a standard action . when you write a portlet that makes use of this UN not right he portlet that is about and specifically to ClearPass the UN do you portal is no point you in court . the ClearPass where you portal or really any JC API to make use of the speech . . what does the league doesn't display properly . settling . yes but if you search for data so Web advisor in chasing twenty you get that page . an entire team cassified that Intel Web advisor and sturdy secrets secrets not the cassified . because when still in there in that solution is replaying the password for the login form using this open source technology that edge but all the pieces their freedoms are software . Separate What advice core . and whenever I mention that al-Sahaf to mention that apparently you can combine API for this or Simpler . . Ward That's . so this was the example . using software to stop the end user's browser through filling up the login form of use and ten T JavaScript . . . the shoe Does trial access sometimes I'd feel obligated see Disclaimer at the beginning with it . we wish you knew something open source and the look Web Access that anyway . fine . so you are but Robson actually edit out this and now . has been very involved in JC in chasm past ten and still Email in this way . I've had a steady solution on Gephardt . we used it up . Committees did . really what an exciting stuff . and Anyware . this is where he should be solution to testify Telegram access . and so those SC show . a piece of solution here with us . it handles the secured last decision was one of those Java servlets that perhaps this community has . come build closer to . what is it do what does all the pieces even talking about contains the prime to take it so that he had authenticates to jazz ClearPass . it uses that proxy take it to actually authenticates a CAS ClearPass to get password . uses the password to compose a form host internally and post that to be Outlook Web Access login form . reading the resulting could use this is not the end user's browser . being stuck through doing that . that's a really radically doing . composing in executing her boss . we in the response that leads the cookie is and their rights to speak ease back to the user's browser and all of this works in terms of the past . the security of the cookies because this thing is running . all right there in front Outlook Web Access . and so it has the authority from the Dodgers perspective to sell the securities for that . . having said this could user then Redirect the user up to the Outlook Web Access Web experience in past login form and said the user has a perfectly valid session thinking . you now login . . . the result is . the test . Outlook Web Access use it as a fighting for recording purposes there were some here quote on the cassified of the and that certainly can then user's perspective use CAS to login to edit . and this into some X happening under the hood to do that password over seventy Commit presented to the web layer of Outlook Web Access presumably Sunni can do interesting things about password in affecting the exchange or whatever happens inside . Outlook Web Access . . another example . it is Examples I think is that what started that is an extension to has any to reference implementation if you will run using it in your portal . he is . snowballing is gaining adoption is Vegas is a convenient way to . Anyware . so interesting behavior in other applications beyond originally anticipated . . Thompson should be here presenting his case certainly do Mobile were . Simpler wrote that Update is doing . . and I am EDT really well to get to the whole forum discussion about . just ask Robin a spirited build the URL to a way that will get you to the Clem discussion . about . doing this in light trade . and I shot a many demanding two million to source code for student Really Works . what are the changes is to use that is a java CAS client library wide because they didn't a hard to take it for the progress of the Bank leading to ClearPass mused about the ticket to actually authenticates the ClearPass to the password . the password into the session where life re . do we would have put in a few used not as rather local Authentication behaviors . and top Portlets can then use it as normal not having to worry themselves about where the password came from the fact that . these things have happened at user login . . . White ClearPass . talked about . it is concrete leading single get the coordinates with economy chalk and small out of code . high end car very much thanks to seven tie to it . the deal said in a law lot of the first pass work on this and certainly deserves credit what people deserve credit . I want talk more broadly though about how this fits because the job would be this is an academic presentation was interesting what about that of course you should never use this ranking . and that's . Not exit routes the job . I just I think this fits . with us . Anyware is incremental adoption of enterprise single sign on . specifically the attacks though you can truly take these ideas until . why them to show wealth and to talk to the right people about that even our to been done . on . insurgent light to adopt single sign on adopt a specific as single sign on one of the impediments you have to that is perhaps do some legacy integration Skilling on that . are you know work . with just plain old CAS . if you've got applications that are truly getting their hands on those users passwords and using them for things . also presented using them for just passwords or dissent useful things . this is going to be a twenty two impediment in a technological impediment you're adopting Jess in the flow . I can't about as big as my crew and needs to have the password to be able to get my e-mail my calendar and you these . quick and are nice and sunny Nations . what about the Jessica Changes By Mike the has the look on a suicide environment ahead anyway and all of this is just too Double KAGAN that is to give up and and . William a unifying the user name space of just having one so the credentials St user those hard enough . and setting up this this enterprise Al that instance was was really well . stop . and Restyle so that news . you can adopt as . you with ClearPass . you can use the code s hard to continue Enable his legacy integration that require no rain in having your hands right on the in huge password you can well that's probably a bad thing . and then try to set some pressure to . got you more about the look to reduce the amount that . but mentor us forward to using cad is Ant as Delegated Annotation the thing we call twenty tickets in tatters . four other words an interaction . this is implemented . incrementally . you get a single sign on you get a centralization of the login experience you Reduce the PRI with ration of password you Reduce the deep ball behavior of every new allocation gets to have its hands right on . the and usage password . and so like . get to that . . . I would like to talk about how this incident that enabled adoption has on your campus . that's life . well surprise . . . . . a Discussions and with the CAS guys see a to convince them . T to put it in that list . and the steamy scenes end of that . one of the time is now walking out of rhythm . . and we were almost on a plane way the political team with ninety recommend CA . then the Clintons new systems that they don't the CAS if they wanted the single sign of impl about his lineups to leaking . what we want state and that of the this Why would be the first place . so eventually I just team conceded that they with details . am I about the at and . we gave them that leads to problems that currently needed password about that no new Portlets would use the password without an opening with that those guys that's . and now they'll stats and said that repeat takes the one year one was re-elected and find out how we progress with the Chiefs and the number over the line from the . one . with the requirements driving the original to buy one of the software for soccer minus eight was to enable adoption of chasm where it was immediately applicable . the Clippers We try . a week . . no joke . yes and you want . we moved yet . . way you . it's that go . . he . another cruise . it's . my . . all . he's awfully secured enough to secure Tuesday . this is better than assaulting other . SEN . Mike utmost our . we are Who We are more . Peoplesoft portal . at Pepperdine read to you . the cassified . but with Celine data . use the fierce you Double cases that people rely on accessing through portal . that them as single sign on . and what Is are more research I reporting system the others but in the eighth . that Term curly the Portals handling seal sign up for . on the my preference is that a large application more troops application like the portal . the be cashing the end user password . but that the CAS server do yet in the end . delivered as as as required it seems like an improvement in security versus Pending Peoplesoft which needs to be passed and has all kinds of entry points Increase ease stuff going on let's who thinks it is doing . also cashing this passwords . party to question him . still to be Cache by home this is mostly in memory session still cashing of password that we're talking about and that's certainly a different proposition than a year persistence across sections Share code a lot Style . . . protecting the user even to store the password into . into an application so that it can do to copy of it . the crew prosthetics . what happened here . and so in some slide knocked occasions about the futures of ClearPass . mostly it's Single things . so certainly there's some criticism of Arlen . including here the password not being encrypted in the cash and should be and it probably should . and so the idea of including the password at last . Eric what's on the address there but that really address in the . ClearPass capture password . which clearly at the is that the cash is not the run flexibility eighty eight Cash and so certainly you don't need to be deliberately catching this out to disk unless you really need it . on a brighter in for a more rigorous analysis of what happens in the core dump and so forth that may not . still be enough . even if huge cache things it's just being cashed in memory . and then one might want to think of that in memory on JC to me has some experience with doing that sort of thing on the New portal side of this of of encrypted browser once it gets to you portal . and so we know the same kind of analysis in the same cut work could be applied be ClearPass . . this is still always the simple thing that can possibly were . it student audience in capturing the password is people credited in the key to the password you use the . identifier of the user that the teacher the and in the Cache the map . com . the using trucks each as to authorized the call blacks to do get a password . this certainly doesn't have any concept of mental ways with any TV user that user having multiple credentials . . and she could only you could use an incremental extension to have multiple instead stations of the ClearPass controller Hamilton call back to URLs for different passwords . the tide turns into a real maps facts . inside think . it remains to be seen whether there really Use cases that drive this seems like the same environment that is going to choose to use ClearPass is the kind of environment that that hasn't gotten a really sophisticated . Model of all there for ways to thank a users maybe that's a naive assumption . stay with this is a bridge that is not yet been cost him a new DB crossed in someone's use of the software . at which point the one figure how to do the right . . with good timing . and then just as I had suggested . we had ten minutes of the and for Questions and Answers and discussion . and so through all those questions and thoughts that you've been holding back on her back no longer . . you . . your CAS leaving Recently three to meet you . was it was a backward three one . what was and he says yes . right so that was originally developed for you portal to six actually . and there's a in contention edit it Works with that legacy . ideal developed Java CAS Client and Cynthia having me do use it on in New portal to six or in the Porfirio which . or even three one which use the client of the codes either . there are more likely gets close and yet to get right to your exact version . on but that certainly a . even compelling starting point for all three of those garments exists . and then yes this guy really makes an Improved refactored in much better off for you portal three two . and then Scott D off and eat as versions that . . this works like melted butter and . impl versus Wednesday . today it Apache's me for a are you portal three outs to plead is no reason CA people push for a and and that's exactly of the portal process beginning Adding lead . of the parallel case of codebases is seeing . catches SecurityContext for you portal seeking . so I the back forty three not one that read I those surveyed Possible and the reason and for it on with Hebrew meaning e . but also in terms Live . CAS releases . Tom I believe we had a table in dire Wiki in nineteen the lowest Reduce three point three dot three at the moment though this is don't as a with his MEANS and work with ones that are for the back . . it's not like to do it . and so improve your local experience in just making it work it did truly quite feasible on the reason . Tom did you pull three to was really targeted as to the release to you . Standardized this and make this a normal thing to do is because that's also the release for we upgraded Scotto created the version of the of the job a CAS client library that it's using . on which is not that big a deal . Tom by IT judges . make it more standard and one adopted so we knew quot three to you get the updated Java CAS client library you get the bomb . compatibility with the latest release of ClearPass with a really clear instructions and I just thought configure it . and that's inserted the place to be . on and if anybody needs to back for it to other versions each as New portal . Let's talk it's not that hard . them . it's . with the latest relationship . yes . the place where the projects passed Stewart team . and the police would action needs to change . were for example Sample . top call Iraq community IChannel Horst work . no relationship . um . DD credentials are stored in this ad hoc and huge cash back to catch and then of course you can configure the cash anyway you want to sell your e in all this . each Cache in all its glory . Tom . Scott I have no up and a lot about we're the bad commutes are being stored I think that using person had to be the first decree API . it's a mostly that's not Cache . Bill it does have in some capture capabilities so you could choose to catch that in the huge catch the to be much more a matter of happening to choose to do that and much less a matter of the system setting any formal relationship . said the momentum to the action heats the air . Ricci from person to Changes to an app assisting me that the prince ball on the in the US forthcoming in Cedar three at five Public change suddenly so that we rely on the casualty build these and the remains of millions of persons acting races to storing them static me I'm app on . and then dead the ClearPass ones is an Dimension of Seward completely separately on know that said pursued entry as a free Build but precisely p I . if you wanted to add another Merge e e like CNN and other procedure team season that made from the cash . and stand though designed to be to but the other ones you probably cannot match I think the president he API St flexible . currently in the new This is a bad architecture of decision that was a simple architectural decision . currently the cast password are treated separately from attributes into print as this perspective . the CAS has risen not be user Attribute . and that is different from the architecture once he gets eighteen citing you for . we're the password is experienced as an actor be right that they come in from different places and has certainly treats them totally separately bomb . if we get to a point where it's really important to somebody to . this is capable of being aware of multiple passwords for user . I think that's the right point to revisit that architectural decision and say whoops I guess passwords are more like capture the its than anybody thought . because you need Multiple of the many do have to use . and so forth . . yes he . you all . you repeat that . . we could look Add these . but time names of persons entry API . and then relying on the services management tool to release that has for to specific applications soon you've made the URL specific enough that you're not the capture to services that you did not intend cents a Oh Amen then you had the same opposition to Bill Using had without having to call back . . late word play NetworkID . this was that three second thought I just had . . . Super only use its battalion we are and then what's all univ auditors that were using proxy jazz and proxy CAS is the way that elsewhere . you can figure it UX is control . on Delegated Annotation when it really matters is a case where really matters . on but it is really at odds with the vaulting . after the release capabilities in Services registry capabilities and configuration and so to from some perspective you're still configuring this in two places . in a Wadi should have to and maybe as this of all this moves into . services registry and the matches User attributes being released in that way . and this poll and clever idea goes away . maybe in the sense that this is something you really shouldn't be here to really it's not going to take extra work . empty . don't ask me guys best many losses code . . the GOF the year . the CAS who to be a . in C Sharp who to sell the place . Double Duty Logging ph were . use that kind of went Separate . it does take away the one in form function from CAS and from what it is a former this is . uses for landing . when somebody to the team team team since I . and when I made it to mean technically it's clear that that login form is still available somewhere at some URL because the chasm in the UAE C sharp code itself requires . in what it does is it issues easy on us to get misbehavior class to close this credentials to a your else they euros last exist whether that UI was then the URL that and users can access SoCal imagine that's up to you . just thinking about without having the code without having talked to build much about it . on Consume to say that it seems like . since the contest posts that URL that URL still exists in you could choose to continue to make that available and so you could certainly in orchestrating experience where buy in if you come code of the UAE from a link from the poor you go through that . the chasm We Are t know you have the CAS single sign on session and singing getting good experience . and if you don't then CAS good will to spot people have the same experience to bow is bad . and to get that points more matter what you wanted to send them the technology . restricting need any particular choice that . . . . . she your intentions . you have to change . so that the genes and . without a long one . the and that debits t show code . in so the idea if somebody decides to change the . Outlook Web Access login form to that different name parameter more clever about Maxine the request in IP adresses of session cookie . right there's a whole different an alarmist but one thing that it seems increasingly popular do is to keep around some added a do with your session cookie and tea session on Server side and say that sessions for this IP address for this profile of a computer and if someone else tries to is that such that he'll not . we're new except it will course the moment that Tom . that all of Web access would choose to make that Architecture decision is the moment the code stopped working because . it's issuing the secured process itself rather than in the end user's browser . so yes it's potentially fragile and risky . and of . I would imagine . perhaps John Murray could talk about much more Principle wasted to be using Semel for the satanic agents . I'm so great but no cut guy . snow was still working No . maybe . in the needs of those from whom . well we'll do Bonnet W E . does one know . among his of his moving from . for Pilgrims since to something more than two . well be treated with equal ease visa them to teach him . and access because when the tool on the on the ballots because you Tim know how to . you are How Does Jong Accounting Search of the world can sell that to someone else . you need to open up and being able to . may . . I didn't need to the reaction from the bases . so the school is still code removed because one side or on what to . these phone . we do for excesses Update four one needs the . it was good to go on because you don't stand everything seemed to change things is thought to be the . so the Getting tiny TV needs cutover stupid and Ecowas to get the view access to three change but bean down . in what it always . and yet the song . version two . the other name . Rome . own the team to Windows so the windows in service . this may twenty Johnson Berkeley . don't know . the Fortune the . the code was different . this means that Jones and Kentucky forms . just don't know . maybe be the end of the U . the old Forums just to get access to . let's . the police the for to but it's not true . TD bring four or Event for the Schindler Bundled employs alf to Boston because of the Produce Dome on been I think someone . while many other quick question before we wrap up there . also a new round and then more one least of it anyway will be around so you can can find people that talk about this . Tuchman This was Further . and on concern a thank you for coming in during a bit about ClearPass . the the the . . . . . . before . .