Shibbolizing Apereo CAS


This is a brief overview that explains how to shibbolize the Apereo CAS server; that is to let the CAS server be protected by an instance of the Shibboleth Service Provider, where the SP is then tasked to delegate authentication requests to a remote SAML2 identity provider. The entire SAML2 interaction is kept between the SP and the IdP while CAS on the return trip eventually picks up the user profile from the SP in form of special headers, etc.

But…Why?

This is a very elaborate setup, yes. The goal originally was to let CAS simply and directly delegate authentication requests to the SAML2 identity provider. This can very easily be done, except that in this particular case the SAML2 identity provider only supported a very specific and rather complicated variation of the SAML2 protocol, whose support is absent in CAS today. Convincing the identity provider to provide support for the more-mainstream SAML2 WebSSO Browser Profile led to a path riddled with uncertainties. After further analysis, we came to the conclusion that implementing built-in support for the IdP-supported SAML2 profile variation in CAS is unnecessarily complicated, needlessly expensive and possibly soon-to-be obsolete.

Of course, it is certainly possible to do. If you have to ask: all you need is love, coffee and access to decent hair conditioning products.

So the path to least resistance turned out to be a deployment with a few additional components and with a clear separation of boundaries. Thanks to Docker and outstanding help from colleagues, we managed to get this working.

Read on.

How

Starting out with a proof of concept, we came up with a dockerized deployment as such:

Shy of a pretty sequence diagram, here’s how the interaction between the above components works:

  1. Client browser attempts to access the sample CASified PHP application.
  2. Requests to the CAS /login endpoint are intercepted by the SP and Apache.
  3. The SP, configured to speak the special SAML2 protocol, routes the request to the IdP.
  4. The IdP accepts user credentials and posts back the response to the SP.
  5. The SP passes the response back to the CAS /login endpoint.
  6. CAS is configured to trust the response and proceeds to extract user profile data from the request.
  7. CAS proceeds to issue an ST for the PHP application that initiated the request.
  8. Having received and validated the ST, user is granted entry to the PHP application.

CAS

We also applied a few minor patches to CAS:

  • Ensure CAS could easily lend itself to be intercepted by Apache when running in embedded mode.
  • Ensure user profile data can correctly be recognized from the SP.
  • Ensure attributes collected from the SP can be merged and combined with CAS’ own, in cases where supplementary attribute sources are directly defined inside CAS.

The trusted authentication piece is already handled by CAS today.

How Do I…?

All patches are contributed back to the CAS project. You are most welcome! :-)

So…

Special thanks to @jtgasper3 for beautifully cementing the deployment foundation of each component via Docker, big kudos to @scalding for making the integration magic work seamlessly and to @apetro for having previously worked on the trusted authentication piece in CAS.

Of course, I intend to take all the credit.

Misagh Moayyed

Related Posts

Apereo CAS - Microsoft Office 365 SAML2 Integration

Learn how to integrate Microsoft Office 365 with Apereo CAS running as a SAML2 identity provider.

Apereo CAS - HappyFox SAML2 Integration

Learn how to integrate HappyFox with Apereo CAS running as a SAML2 identity provider.

Apereo CAS - Cisco Webex SAML2 Integration

Learn how to integrate Cisco Webex with Apereo CAS running as a SAML2 identity provider.

Apereo CAS - VMware Identity Manager SAML2 Integration

Learn how to integrate VMware Identity Manager with Apereo CAS running as a SAML2 identity provider.

CAS 6.0.0 RC4 Feature Release

...in which I present an overview of CAS 6.0.0 RC4 release.

Apereo CAS - Scripting Multifactor Authentication Triggers

Learn how Apereo CAS may be configured to trigger multifactor authentication using Groovy conditionally decide whether MFA should be triggered for internal vs. external access, taking into account IP ranges, LDAP groups, etc.

Apereo CAS 6.0.x - Building CAS Feature Modules

An overview of how various CAS features modules today can be changed and tested from the perspective of a CAS contributor working on the codebase itself to handle a feature request, bug fix, etc.

CAS 6.0.x Deployment - WAR Overlays

Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps.

Apereo CAS - Jib at CAS Docker Images

Learn how you may use Jib, an open-source Java containerizer from Google, and its Gradle plugin to build CAS docker images seamlessly without stepping too deep into scripting Dockerfile commands.

Apereo CAS 6 - Administrative Endpoints & Monitoring

Gain insight into your running Apereo CAS 6 deployment in production. Learn how to monitor and manage the server by using HTTP endpoints and gather metrics to diagnose issues and improve performance.