SAML2 Authentication

CAS can act as a SAML2 identity provider accepting authentication requests and producing SAML assertions.

If you intend to allow CAS to delegate authentication to an external SAML2 identity provider, you need to review this guide.

SAML Specification

This document solely focuses on what one might do to turn on SAML2 support inside CAS. It is not to describe/explain the numerous characteristics of the SAML2 protocol itself. If you are unsure about the concepts referred to on this page, please start with reviewing the SAML2 Specification.

Federation Interop Evaluation

The CAS project strives to conform to the SAML V2.0 Implementation Profile for Federation Interoperability. An evaluation of the requirements against the current CAS release is available here. It is recommended that you view, evaluate and comment on functionality that is currently either absent or marked questionable where verification is needed.

SAML Endpoints

The following CAS endpoints respond to supported SAML2 profiles:

  • /idp/error
  • /idp/profile/SAML2/Redirect/SSO
  • /idp/profile/SAML2/POST/SSO
  • /idp/profile/SAML2/POST-SimpleSign/SSO
  • /idp/profile/SAML2/POST/SLO
  • /idp/profile/SAML2/Redirect/SLO
  • /idp/profile/SAML2/Unsolicited/SSO
  • /idp/profile/SAML2/SOAP/ECP
  • /idp/profile/SAML2/SOAP/AttributeQuery
  • /idp/profile/SAML1/SOAP/ArtifactResolution

Metadata Management

Handling and storing SAML2 identity provider or service provider metadata can be done in a few ways. To learn more, please review this guide.

Configuration

Support is enabled by including the following dependency in the WAR overlay:

1
2
3
4
5

<dependency>
  <groupId>org.apereo.cas</groupId>
  <artifactId>cas-server-support-saml-idp</artifactId>
  <version>${cas.version}</version>
</dependency>

1

implementation "org.apereo.cas:cas-server-support-saml-idp:${project.'cas.version'}"

1
2
3
4
5
6
7
8
9

dependencyManagement {
  imports {
    mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
  }
}

dependencies {  
  implementation "org.apereo.cas:cas-server-support-saml-idp"
}

You may also need to declare the following repository in your CAS overlay to be able to resolve dependencies:

1
2
3
4
5
6

repositories {
    maven { 
        mavenContent { releasesOnly() }
        url "https://build.shibboleth.net/maven/releases/" 
    }
}

The following settings and properties are available from the CAS configuration catalog:

The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting may be needed to activate or affect the behavior of the CAS feature and generally should be reviewed, possibly owned and adjusted. If the setting is assigned a default value, you do not need to strictly put the setting in your copy of the configuration, but should review it nonetheless to make sure it matches your deployment expectations.

  • cas.authn.saml-idp.core.entity-id=https://cas.example.org/idp

    • The SAML entity id for the deployment.

    This setting supports the Spring Expression Language.

    org.apereo.cas.configuration.model.support.saml.idp.SamlIdPCoreProperties.