cas票据过期策略

左手的ㄟ右手 2023-02-18 14:27 33阅读 0赞

由于cas官网经常访问不了，转到此处备忘

票据过期策略

# Ticket Expiration Policies #

CAS supports a pluggable and extensible policy framework to control the expiration policy of ticket-granting tickets (`TGT`), proxy-granting tickets (`PGT`), service tickets (`ST`) and proxy tickets (`PT`).

**There Is More**

There are many other types of artifacts in CAS that take the base form of a ticket abstraction. Each protocol or feature may introduce a new ticket type that carries its own expiration policy and you will need to consult the documentation for that feature or behavior to realize how expiration policies for its own ticket types may be tuned and controlled.

## Ticket-Granting Ticket Policies ##

TGT expiration policy governs the time span during which an authenticated user may grant STs with a valid (non-expired) TGT without having to re-authenticate. An attempt to grant a ST with an expired TGT would require the user to re-authenticate to obtain a new (valid) TGT.

### Default ###

This is default option, which provides a hard-time out as well as a sliding window.

To see the relevant list of CAS properties, please [review this guide][].

### Timeout ###

The expiration policy applied to TGTs provides for most-recently-used expiration policy, similar to a Web server session timeout. For example, a 2-hour time span with this policy in effect would require a TGT to be used every 2 hours or less, otherwise it would be marked as expired.

To see the relevant list of CAS properties, please [review this guide][].

### Hard Timeout ###

The hard timeout policy provides for finite ticket lifetime as measured from the time of creation. For example, a 4-hour time span for this policy means that a ticket created at 1PM may be used up until 5PM; subsequent attempts to use it will mark it expired and the user will be forced to re-authenticate.

To see the relevant list of CAS properties, please [review this guide][].

### Throttled ###

The throttled timeout policy extends the TimeoutExpirationPolicy with the concept of throttling where a ticket may be used at most every N seconds. This policy was designed to thwart denial of service conditions where a rogue or misconfigured client attempts to consume CAS server resources by requesting high volumes of service tickets in a short time.

To see the relevant list of CAS properties, please [review this guide][].

### Never ###

The never expires policy allows tickets to exist indefinitely.

**Usage Warning!**

Use of this policy has significant consequences to overall security policy and should be enabled only after thorough review by a qualified security team. There are also implications to server resource usage for the ticket registries backed by filesystem storage. Since disk storage for tickets can never be reclaimed for those registries with this policy in effect, use of this policy with those ticket registry implementations is strongly discouraged.

## Service Ticket Policies ##

ST expiration policy governs the time span during which an authenticated user may attempt to validate an ST.

### Default ###

This is the default policy applied to service tickets where a ticket is expired after a fixed number of uses or after a maximum period of inactivity elapses. This is the default and only option.

To see the relevant list of CAS properties, please [review this guide][review this guide 1].

## Proxy Ticket Policies ##

PT expiration policy governs the time span during which an authenticated user may attempt to validate an PT.

### Default ###

This is the default policy applied to proxy tickets where a ticket is expired after a fixed number of uses or after a maximum period of inactivity elapses. This is default and only option.

To see the relevant list of CAS properties, please [review this guide][review this guide 2].

## Proxy-Granting Ticket Policies ##

PGT expiration policy governs the time span during which CAS may grant PTs with a valid (non-expired) PGT. At this time, the expiration policy assigned to proxy-granting tickets is controlled by the same policy assigned to ticket-granting tickets.

To see the relevant list of CAS properties, please [review this guide][review this guide 3].

## TGT过期策略 ##

## TGT Expiration Policy ##

Ticket expiration policies are activated in the following conditions:

*  If the timeout values for the default policy are all set to zero or less, CAS shall ensure tickets are *never* considered expired.
 *  Disabling a policy requires that all its timeout settings be set to a value equal or less than zero.
 *  If not ticket expiration policy is determined, CAS shall ensure the ticket are *always* considered expired.

**Keep What You Need!**

You are encouraged to only keep and maintain properties and settings needed for a particular policy. It is **UNNECESSARY** to grab a copy of all fields or keeping a copy as a reference while leaving them commented out. This strategy would ultimately lead to poor upgrades increasing chances of breaking changes and a messy deployment at that.

Ticket expiration policies are activated in the following order:

1.  Tickets are never expired, if and when settings for the default policy are configured accordingly.
2.  Timeout
3.  Default
4.  Throttled Timeout
5.  Hard Timeout
6.  Tickets always expire immediately.

### Default ###

Provides a hard-time out as well as a sliding window.

<table> 
 <tbody> 
  <tr> 
   <td> <pre><code>1
2
3
</code></pre> </td> 
   <td> <pre><code># Set to a negative value to never expire tickets
# cas.ticket.tgt.maxTimeToLiveInSeconds=28800
# cas.ticket.tgt.timeToKillInSeconds=7200
</code></pre> </td> 
  </tr> 
 </tbody> 
</table>

### Remember Me ###

<table> 
 <tbody> 
  <tr> 
   <td> <pre><code>1
2
</code></pre> </td> 
   <td> <pre><code># cas.ticket.tgt.rememberMe.enabled=true
# cas.ticket.tgt.rememberMe.timeToKillInSeconds=28800
</code></pre> </td> 
  </tr> 
 </tbody> 
</table>

### Timeout ###

The expiration policy applied to TGTs provides for most-recently-used expiration policy, similar to a Web server session timeout.

<table> 
 <tbody> 
  <tr> 
   <td> <pre><code>1
</code></pre> </td> 
   <td> <pre><code># cas.ticket.tgt.timeout.maxTimeToLiveInSeconds=28800
</code></pre> </td> 
  </tr> 
 </tbody> 
</table>

### Throttled Timeout ###

The throttled timeout policy extends the Timeout policy with the concept of throttling where a ticket may be used at most every N seconds.

<table> 
 <tbody> 
  <tr> 
   <td> <pre><code>1
2
</code></pre> </td> 
   <td> <pre><code># cas.ticket.tgt.throttledTimeout.timeToKillInSeconds=28800
# cas.ticket.tgt.throttledTimeout.timeInBetweenUsesInSeconds=5
</code></pre> </td> 
  </tr> 
 </tbody> 
</table>

### Hard Timeout ###

The hard timeout policy provides for finite ticket lifetime as measured from the time of creation.

<table> 
 <tbody> 
  <tr> 
   <td> <pre><code>1</code></pre> </td> 
   <td> <pre><code># cas.ticket.tgt.hardTimeout.timeToKillInSeconds=28800
</code></pre> </td> 
  </tr> 
 </tbody> 
</table>

[review this guide]: https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties.html#tgt-expiration-policy
[review this guide 1]: https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties.html#service-tickets-behavior
[review this guide 2]: https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties.html#proxy-tickets-behavior
[review this guide 3]: https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties.html#proxy-granting-tickets-behavior