/// <summary> /// Handles the authentication of the request. /// /// If the request contains a ticket, this will validate the ticket and create a /// FormsAuthenticationTicket and encrypted cookie container for it. It will redirect /// to remove the ticket from the URL. With Forms-based authentication, this is /// required to prevent the client from automatically/silently re-authenticating on a /// refresh or after logout. /// /// If the request does not contain a ticket, it checks for a FormsAuthentication /// cookie, decrypts it, extracts the FormsAuthenticationTicket, verifies that it /// exists in the StateProvider/ServiceTicketManager, and assigns a Principal to the /// thread and context.User properties. All events after this request become /// authenticated. /// </summary> /// <param name="sender">The HttpApplication that sent the request</param> /// <param name="e">Not used</param> private static void OnAuthenticateRequest(object sender, EventArgs e) { HttpContext context = HttpContext.Current; HttpRequest request = context.Request; // Validate the ticket coming back from the CAS server if (!RequestEvaluator.GetRequestIsAppropriateForCasAuthentication()) { logger.Debug("AuthenticateRequest bypassed for " + request.RawUrl); return; } // Validate the ticket coming back from the CAS server if (RequestEvaluator.GetRequestHasCasTicket()) { logger.Info("Processing Proxy Callback request"); CasAuthentication.ProcessTicketValidation(); } logger.Debug("Starting AuthenticateRequest for " + request.RawUrl); CasAuthentication.ProcessRequestAuthentication(); logger.Debug("Ending AuthenticateRequest for " + request.RawUrl); }