Re: URL refresh in passive mode

Scott Tully wrote:

>Sameer-
>
>->>When the renew form is resubmitted every 450 seconds it resets the 
>->>header which contains the meta refresh that sends the ticket to the 
>->>gateway ASAP, or 5 seconds, to notify the gateway that the user is 
>->>still there... so you really get 455 seconds between renews....
>->>
>->>  
>->>
>->Scott,
>->Thanks for the reply. It clears up a lot of things.
>->
>->So the ticket gets refreshed every 450+5 seconds? What does 
>->the ticket 
>->really do? I compared the tickets over a few hours, and I see 
>->that the 
>->tickets are different indeed. What purpose does the ticket 
>->serve, if the 
>->popup is going to talk to the auth server every 450 seconds anyway?
>->--
>->Sameer
>->
>
>The popup only talks to the Authserver to re-authenticate the user. The
>popup is really a way for the Authserver to bounce a http request off
>the client machine to the gateway. It's the only way the authserver can
>get the ticket to the gateway when it's nat'ed on a LAN. (OK, not the
>only way, but it makes NoCat easy to distribute) 
>
>The ticket contains user specific data like username, mac, and group
>encrypted in a gpg encoded string. The ticket is how the gateway knows
>to renew a specific user session. The session is renewed for another 600
>seconds or whatever the timeout is set to (450 insures that the request
>is received in time). If the gateway doesn't receive the ticket in 600
>seconds, then the session expires and the user gets denied then
>re-captured and directed back to the login...   
>
>Or something like that.....
>
>Scott
>
>  
>
Thanks for the enlightenment Scott. You really cleared up several things 
for me. I really appreciate it.
cheers,
--
Sameer