Single Sign-On Implementation Using CAS + Spring Security

Question

I am trying to implement SSO in several web applications using CAS and Spring Security. Expected Case:
CAS - http: // localhost: 8080 / cas /
Secure Content Application - http: // localhost: 8081 / cas-client1 / secure / index.html
Secure Content for Application B - http: // localhost: 8081 / cas-client2 / secure / index.html

1) When user access to cas-client1, a CAS login form appears and initiates authentication.
2) The same user access is cas-client2, the previous login must be recognized, and the login form will not be requested

However, I could not complete step 2. The CAS registration form is still requested by the user and therefore requires a double login. Is there a misconfiguration in my Spring Security configuration:

<security:http entry-point-ref="casAuthenticationEntryPoint" auto-config="true"> <security:intercept-url pattern="/secure/**" access="ROLE_USER" /> <security:custom-filter position="CAS_FILTER" ref="casAuthenticationFilter" /> </security:http> <bean id="casAuthenticationEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"> <property name="loginUrl" value="http://localhost:8080/cas/login" /> <property name="serviceProperties" ref="serviceProperties" /> </bean> <bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties"> <!-- http://localhost:8081/cas-client2 for app 2--> <property name="service" value="http://localhost:8081/cas-client1/j_spring_cas_security_check" /> </bean> <security:authentication-manager alias="authenticationManager"> <security:authentication-provider ref="casAuthenticationProvider" /> </security:authentication-manager> <bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter"> <property name="authenticationManager" ref="authenticationManager" /> <property name="authenticationFailureHandler"> <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"> <property name="defaultFailureUrl" value="/casfailed.jsp" /> </bean> </property> </bean> <bean id="casAuthenticationProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider"> <property name="userDetailsService" ref="userService" /> <property name="serviceProperties" ref="serviceProperties" /> <property name="ticketValidator"> <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"> <constructor-arg index="0" value="http://localhost:8080/cas" /> </bean> </property> <property name="key" value="an_id_for_this_auth_provider_only" /> </bean> <security:user-service id="userService"> <security:user name="wilson" password="wilson" authorities="ROLE_USER" /> </security:user-service> 

Answer 1

Finally, the problem is resolved. My CAS uses HTTP and therefore it is necessary to set secure cookies to false.

Change TicketGrantingTicketCookieGenerator.xml

 p:cookieSecure="false"