Shibbolizing Apereo CAS


This is a brief overview that explains how to shibbolize the Apereo CAS server; that is to let the CAS server be protected by an instance of the Shibboleth Service Provider, where the SP is then tasked to delegate authentication requests to a remote SAML2 identity provider. The entire SAML2 interaction is kept between the SP and the IdP while CAS on the return trip eventually picks up the user profile from the SP in form of special headers, etc.

But…Why?

This is a very elaborate setup, yes. The goal originally was to let CAS simply and directly delegate authentication requests to the SAML2 identity provider. This can very easily be done, except that in this particular case the SAML2 identity provider only supported a very specific and rather complicated variation of the SAML2 protocol, whose support is absent in CAS today. Convincing the identity provider to provide support for the more-mainstream SAML2 WebSSO Browser Profile led to a path riddled with uncertainties. After further analysis, we came to the conclusion that implementing built-in support for the IdP-supported SAML2 profile variation in CAS is unnecessarily complicated, needlessly expensive and possibly soon-to-be obsolete.

Of course, it is certainly possible to do. If you have to ask: all you need is love, coffee and access to decent hair conditioning products.

So the path to least resistance turned out to be a deployment with a few additional components and with a clear separation of boundaries. Thanks to Docker and outstanding help from colleagues, we managed to get this working.

Read on.

How

Starting out with a proof of concept, we came up with a dockerized deployment as such:

Shy of a pretty sequence diagram, here’s how the interaction between the above components works:

  1. Client browser attempts to access the sample CASified PHP application.
  2. Requests to the CAS /login endpoint are intercepted by the SP and Apache.
  3. The SP, configured to speak the special SAML2 protocol, routes the request to the IdP.
  4. The IdP accepts user credentials and posts back the response to the SP.
  5. The SP passes the response back to the CAS /login endpoint.
  6. CAS is configured to trust the response and proceeds to extract user profile data from the request.
  7. CAS proceeds to issue an ST for the PHP application that initiated the request.
  8. Having received and validated the ST, user is granted entry to the PHP application.

CAS

We also applied a few minor patches to CAS:

  • Ensure CAS could easily lend itself to be intercepted by Apache when running in embedded mode.
  • Ensure user profile data can correctly be recognized from the SP.
  • Ensure attributes collected from the SP can be merged and combined with CAS’ own, in cases where supplementary attribute sources are directly defined inside CAS.

The trusted authentication piece is already handled by CAS today.

How Do I…?

All patches are contributed back to the CAS project. You are most welcome! :-)

So…

Special thanks to @jtgasper3 for beautifully cementing the deployment foundation of each component via Docker, big kudos to @scalding for making the integration magic work seamlessly and to @apetro for having previously worked on the trusted authentication piece in CAS.

Of course, I intend to take all the credit.

Misagh Moayyed

Related Posts

Apereo CAS - Extending Webflows

Learn and master extending CAS 5 Spring Webflow definitions.

Apereo CAS - Administrative Endpoints & Monitoring

Gain insight into your running Apereo CAS deployment in production. Learn how to monitor and manage the server by using HTTP endpoints and gather metrics to diagnose issues and improve performance.

Apereo CAS - Custom Authentication & Attribute Sources

Master writing custom authentication handlers/schemes in CAS and learn how to design custom data sources that can produce user claims and attributes.

Apereo CAS - User Interface Customizations

A short tutorial on Apereo CAS user interface customizations, including themes, localization and dynamic views for all those who enjoy front-end development and suffer from instant gratification.

CAS Multifactor Authentication with Google Authenticator

A short walkthrough to demonstrate how one might turn on multifactor authentication with CAS using Google Authenticator, leveraging a variety of triggers.

CAS 5.3.x Deployment - WAR Overlays

Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps.

CAS 5.3.0 RC4 Feature Release

...in which I present an overview of CAS 5.3.0 RC4 release.

Apereo CAS - Identity Impersonation

You do not always have to be you. Allow the Apereo CAS server to allow you to pretend to be another person for fun and profit.

Apereo CAS - Customized Settings

Extend the Apereo CAS server to allow custom configuration properties and settings.

Apereo CAS - Handling Multiple Logout URLs

Extend the Apereo CAS server to allow for multiple logout URLs during SLO operations.