Child pages
  • Using CAS without the Login Screen
Skip to end of metadata
Go to start of metadata


We wanted to be more flexible in the use of the login UI, so e.g. wanted to embed it in several places as a small panel. Moreover, we wanted to understand CAS as a pure service, not having to maintain layout information twice. Also, we wanted to support both, login postings from another site and direct login at the CAS server as a fallback.

Other proposed solutions

Proposed Solutions that do not work 

There have been two proposals, which we haven't found to be suitable:

  • AJAX: Ajax requests are sandboxed and that sandbox is even more strict than the two-dot rule applied to cookies: It really has to be exactly the same server name in order to work
  • IFrames: In this posting to the cas-dev mailing list, it has been suggested to use an iFrame to embed a login panel on a remote site. This has two limitations:
    • How to get rid of the Frame after login? in the default view a successful login would lead to redirect only in that frame. If you use target="parent" in the from tag, how do you display errors then?
    • You would have limited layout possibilities.

 So for our requirements, none of the proposed solutions were adequate.

Our Solution

We decided to use Javascript triggered redirects, which allows us to use this mechanism also on static html pages (e.g. CMS based contents). While loading we request a login ticket, then the login form displays and then it submits to the CAS login URL. If Errors are present at CAS we redirect to the referring page, adding a parameter "error_message" to that request.

Client side 

Here is the static remote login form we use:


CAS side

Adapting only the views and introducing if-else statements there meant having logic that belongs to the controllers in the view. Therefore we decided to inject our add-on into the spring web flow. Here are the changes we have made to login-webflow.xml (changes highlighted in blue):


<start-state idref="provideLoginTicketToRemoteRequestor" />

<action-state id="provideLoginTicketToRemoteRequestor">
<action bean="provideLoginTicketToRemoteRequestorAction" />
<transition on="loginTicketRequested" to="viewRedirectToRequestor" />
<transition on="continue" to="automaticCookiePathSetter" />

<view-state id="viewRedirectToRequestor" view="bmRedirectToRequestorView">
<transition on="submit" to="bindAndValidate" />


<transition on="errorForRemoteRequestor" to="viewRedirectToRequestor" />


 Problems encountered and suggested solutions

The solution works well, but it has a very dirty edge: introducing a new event in the submit method that allows us to distinguish between a login posting from the CAS Site and another site. Here we had to redeclare the submit method in org.jasig.cas.web.flow.AuthenticationViaFormAction (changes marked in blue):

            // START: ChangesBusinessMart: check, whether the posting has been sent from a remote server
            String myServerName = request.getLocalName();
            String referrer = request.getParameter("login-at");
            if (referrer != null && referrer.indexOf(myServerName) == -1) {
                return result("errorForRemoteRequestor");

 This could have been avoided by

  1. making this submit method overridable (non-final) to add new events in a derived class. Or
  2. to make such a distinction of events in the standard CAS distribution.

Maybe this can be accomplished somehow in future versions of CAS?

Listing of the other files mentioned in this solution 

provideLoginTicketToRemoteRequestorAction -> introduces a new parameter get-lt to signal that a new login ticket shall be issued to the HTTP Referer:

viewRedirectToRequestor actually does the redirects to the referrer:


And for completeness, here is the CasUtility that removes obsolete parameters from the query string:

  • No labels


  1. The IFRAME method actually does work. As stated in emails on the CAS developer's list, it requires replacing the default view with a JavaScript redirect view.

    This allows the following:
    (a) errors will continue to be displayed correctly (in the iframe)
    (b) redirects the browser correctly
    (c) usernames and passwords are never collected on the client application

  2. Hi there,
    I made the changes described here, but I'm stuck with these problems:
    - Where the file "viewRedirectToRequestor.jsp" must be placed ?
    - There isn't the definition of bean with class "ProvideLoginTicketToRemoteRequestorAction" in "applicationContext.xml".
    - After adding it, I get the exception:

    2007-07-09 17:08:18,773 ERROR [org.apache.catalina.core.ContainerBase.[Catalina].[].[/].[cas]] - Servlet.service() for servlet cas threw exception
        at sun.reflect.InstantiationExceptionConstructorAccessorImpl.newInstance(

    And CAS shows its generic exception page "CAS is unavailable".

    Where am I wrong ?

    Somebody can help, please ?

    Thanks in advance.


  3. A much simpler and elegant version is to not deal with getting a login ticket at all and to simply auto submit the CAS form via Javascript if a param such as 'auto' is submitted to the login form along with the service, username, and password parameters.

    Example of casLoginView.jsp:

    No fuss, no muss. CAS will then redirect back to your service url with a ticket that is ready to be validated. This comes in really handy if you are doing something like creating users in your system and then auto logging them in after the creation process.

    I know purists will hate the fact that we put a scriptlet in there (i'm not too wild about it either), but it is alot easier than all the redirects involved for grabbing a login ticket just to submit credentials.

    Just a note, you will also want to change the name of the submit button from 'submit' or else Javascript will have a fit. Hope this helps.

  4. Here's a tardy response to Alberto Mozzone's post. Sorry for not having answered any earlier. But better late than never (wink) It still seems to be of interest:

    I have forgotten to mention in this article that the view bmRedirectToRequestorView needs to be defined in the file, which is located at "/WEB-INF/classes". The following entries need to be added there:

    ### Redirect with login ticket view

    Moreover, Alberto was also quite right that the bean "provideLoginTicketToRemoteRequestorAction" has to be defined somewhere. I did that in /WEB-INF/cas-servlet.xml:

    class="de.businessmart.sso.cas.flow.ProvideLoginTicketToRemoteRequestorAction" />

    With these 2 little additions the solution description should be complete.

  5. Hi,

    This was a nice article. But i need to do the same with that latest version of CAS i.e. 3.4 . Can you please provide me the steps for the same. Atleast the stucture for login-webflow.xml as it is now using spring-webflow-2.0.xsd .

    Thanks in advance.

    Gaurav Saxena

    1. I have the same question.  Does anyone have any tips on doing this in CAS 3.4.x and is there now a different way of accomplishing it with the new version?  My end goal is to alter the Liferay login portlet to submit credentials to CAS over https.  Out of the box IFrame portlets would hard code the service URL, breaking deep link capabilities.  Thank you - Ed

    2. Looking to do the same thing in CAS 3.4.6 (using the Maven2 overlay method).  It looks like login-webflow.xml has changed dramatically since this page was created.

      1. Hi, I just want to find out if you were able to have this working. If you did, really would like to find out how you did it. Thanks in advance.

  6. If you want evict client redirection, what is proposed solution here, I think that is possible in do an external login html form implementing a org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction like SPNEGO, X509 Certificates or remote trusted client are doing. With that philosophy, its easy have the login layout outside and the authentication logic inside CAS.

    Our action inspect the request for a username and password field and construct a UsernamePasswordCredentials with that request info.

    Concrete, in my system i have chained the X509 and the trusted (the first to do support for client certs and the last, to do support NTLM or Apache mod_aut_cas) non interactive check and last my AuthenticationNonInteractiveViaFormAction. I said "last" because the last authenticatior in chain always redirect to login form and in my action I save the validation errors like bindAndValidate phase of viewLoginForm are doing, and then the errors are magically rendered in the default cas login form (smile) 

  7. Thanks

    I have finished this with cas server 3.5.1


    one more paramenters "lt" need, see


    1. Hi Chenshi,

                         The link you provided ( is not displaying correctly in my browser may be due to the page in a different language than english.

      Can you please provide a tutorial link having contents written in english.

      Thanks for your help.

    2. Hi Chenshi,

                         The link you provided ( is not displaying correctly in my browser may be due to the page in a different language than english.

      Can you please provide a tutorial link having contents written in english.

      Thanks for your help.

    3. Hi Chenshi,

                         The link you provided ( is not displaying correctly in my browser may be due to the page is written in a different language than english.

      Can you please provide a tutorial link having contents written in english.

      Thanks for your help.