Question

I am setting up my own CAS. A authentication handler was written and username/password are authenticated against a MySQL db. I also add signup page and related logic.

Now I would like to let user automatically log on when he/she has registered as a user. How to achieve this?

Answer 1

Here is my implementation. The idea is borrowed from class org.jasig.cas.web.flow.AuthenticationViaFormAction.

In my web controller handling unlock request which is often from a registration email of a new user.

        String oneTimeAuthToken = this.userManager.generateOneTimeAuthToken(userEmail);
        UsernamePasswordCredentials credentials = new UsernamePasswordCredentials();
        credentials.setUsername(userEmail);
        credentials.setPassword(oneTimeAuthToken);
        String tgt = centralAuthenticationService.createTicketGrantingTicket(credentials);
        ticketGrantingTicketCookieGenerator.addCookie(request, response, tgt);
        log.debug("Current user was unlocked and logged in.");

The fundamentals behind this is to create a temp password-like token to authenticate. Of course, userManager should clear this token automatically once authentication is successful.

Hope this is clear. Let me know if you observe anything wrong.