From 71aa94e99fd15e67ca200820c722f7ec5a3a97ad Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Tue, 03 Nov 2026 21:04:42 +0000
Subject: [PATCH] Require HTTPS for proxy granting ticket callback by default

---
 README.md |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index ac27566..e0f0c1c 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,6 @@
 
 The following features are **missing**:
 * SAML request/response [CAS 3.0 - optional]
-* Proxy ticket service and proxy ticket validation [CAS 2.0]
 
 The following features are out of scope:
 * Long-Term Tickets - Remember-Me [CAS 3.0 - optional]
@@ -33,7 +32,7 @@
 Quarkus is the default distribution method of Keycloak 17.0.0 and newer. For legacy installations using WildFly, please refer to the [old README](https://github.com/jacekkow/keycloak-protocol-cas/blob/16.1.1/README.md).
 
 1. Download the latest release compatible with your Keycloak version from the [releases page](https://github.com/jacekkow/keycloak-protocol-cas/releases).
-2. Put the downloaded JAR file into the `providers/` directory inside Keycloak installation folder.
+2. Put the downloaded JAR file into the `providers/` directory inside Keycloak installation folder. If necessary, adjust the permissions/ownership so that the user Keycloak runs as is able to read this file.
 3. Stop the Keycloak server.
 4. (Re-)build the installation using `kc.sh build` command.
 5. Start the Keycloak: `kc.sh start`
@@ -55,6 +54,9 @@
 In such case append `/login` to the CAS URL to get the "login URL".
 Similarly append `/serviceValidate` to get the "validate URL".
 
+Proxy callback URLs (`pgtUrl`) must match the client's redirect URIs and use HTTPS.
+Plain HTTP is accepted only if the realm's "Require SSL" setting allows it.
+
 ## Disclaimer
 
 This plugin was implemented from scratch to comply to the official CAS protocol specification,

--
Gitblit v1.10.0