Enterprise Single Sign-On for All

View on GitHub

Configuration

The CAS authentication process is primarily controlled by an authentication manager, which orchestrates a collection of authentication handlers.

Authentication Manager

CAS ships with a single yet flexible authentication manager which performs authentication according to the following contract.

For each given credential do the following:

  1. Iterate over all configured authentication handlers.
  2. Attempt to authenticate a credential if a handler supports it.
  3. On success attempt to resolve a principal.
  4. Check whether a resolver is configured for the handler that authenticated the credential.
  5. If a suitable resolver is found, attempt to resolve the principal.
  6. If a suitable resolver is not found, use the principal resolved by the authentication handler.
  7. Check whether the security policy (e.g. any, all) is satisfied.
  8. If security policy is met return immediately.
  9. Continue if security policy is not met.
  10. After all credentials have been attempted check security policy again and throw AuthenticationException if not satisfied.

There is an implicit security policy that requires at least one handler to successfully authenticate a credential.

To see the relevant list of CAS properties, please review this guide.

Authentication Handlers

There are a variety of authentication handlers and schemes supported by CAS. Use the menu to navigate around the site and choose.

Default Credentials

To test the default authentication scheme in CAS, use casuser and Mellon as the username and password respectively. These are automatically configured via the static authencation handler, and MUST be removed from the configuration prior to production rollouts.

Principal Resolution

Please see this guide more full details on principal resolution.

Principal Transformation

Authentication handlers that generally deal with username-password credentials can be configured to transform the user id prior to executing the authentication sequence.

To see the relevant list of CAS properties, please review this guide.

Long Term Authentication

CAS has support for long term Ticket Granting Tickets, a feature that is also referred to as “Remember Me” to extends the length of the SSO session beyond the typical configuration. Please see this guide for more details.

Proxy Authentication

Please see this guide for more details.

Multi-factor Authentication (MFA)

Please see this guide for more details.

Login Throttling

CAS provides a facility for limiting failed login attempts to support password guessing and related abuse scenarios. Please see this guide for additional details on login throttling.

A ticket-granting cookie is an HTTP cookie set by CAS upon the establishment of a single sign-on session. This cookie maintains login state for the client, and while it is valid, the client can present it to CAS in lieu of primary credentials. Please see this guide for additional details.