Central Authentication Service
<templatestyles src="Module:Hatnote/styles.css"></templatestyles>
The Central Authentication Service (CAS) is a single sign-on protocol for the web.[1] Its purpose is to permit a user to access multiple applications while providing their credentials (such as userid and password) only once. It also allows web applications to authenticate users without gaining access to a user's security credentials, such as a password. The name CAS also refers to a software package that implements this protocol.
Description
The CAS protocol involves at least three parties: a client web browser, the web application requesting authentication, and the CAS server. It may also involve a back-end service, such as a database server, that does not have its own HTTP interface but communicates with a web application.
When the client visits an application desiring to authenticate to it, the application redirects it to CAS. CAS validates the client's authenticity, usually by checking a username and password against a database (such as Kerberos, LDAP or Active Directory).
If the authentication succeeds, CAS returns the client to the application, passing along a security ticket. The application then validates the ticket by contacting CAS over a secure connection and providing its own service identifier and the ticket. CAS then gives the application trusted information about whether a particular user has successfully authenticated.
CAS allows multi-tier authentication via proxy address. A cooperating back-end service, like a database or mail server, can participate in CAS, validating the authenticity of users via information it receives from web applications. Thus, a webmail client and a webmail server can all implement CAS.
History
CAS was conceived and developed by Shawn Bayern of Yale University Technology and Planning. It was later maintained by Drew Mazurek at Yale. CAS 1.0 implemented single-sign-on. CAS 2.0 introduced multi-tier proxy authentication. Several other CAS distributions have been developed with new features.
In December 2004, CAS became a project of the Java in Administration Special Interest Group (JASIG), which is as of 2008 responsible for its maintenance and development. Formerly called "Yale CAS", CAS is now also known as "Jasig CAS".
In December 2006, the Andrew W. Mellon Foundation awarded Yale its First Annual Mellon Award for Technology Collaboration, in the amount of $50,000, for Yale's development of CAS.[2] At the time of that award CAS was in use at "hundreds of university campuses (among other beneficiaries)".
In May 2014, CAS Protocol specification 3.0 was released.[3]
CAS Server features
- Open Source licensed under Apache v2; https://github.com/Jasig/cas
- CAS protocol (both as an identity provider and a service provider)
- OpenID (both as an identity provider and a service provider)
- OAuth (both as an identity provider and a service provider)
- SAML v1.1 protocol
- SAML v2 identity provider; reserved for GoogleApps integration
- SAML v2 as a service provider
- WsFed protocol (as a service provider to integrate with ADFS)
- Clearpass; capture, cache, encrypt and provide the user credential to the application
- High availability and clustering via distributed caches such Ehcache, Hazelcast, Memcached, etc.
- Management interface to handle application registration and metadata
- Rich attribute resolution/filtering model
- Support for variety of authentication sources such as LDAP, JDBC, SPNEGO, RADIUS, JAAS, etc.
See also
- CoSign single sign on
- JOSSO
- List of single sign-on implementations
- OpenAM
- OpenID
- Pubcookie
- SAML
- SAML-based products and services
- Shibboleth (Internet2)
References
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
