SAML2 Authentication
CAS can act as a SAML2 identity provider accepting authentication requests and producing SAML assertions.
If you intend to allow CAS to delegate authentication to an external SAML2 identity provider, you need to review this guide.
This document solely focuses on what one might do to turn on SAML2 support inside CAS. It is not to describe/explain the numerous characteristics of the SAML2 protocol itself. If you are unsure about the concepts referred to on this page, please start with reviewing the SAML2 Specification.
Federation Interop Evaluation
The CAS project strives to conform to the SAML V2.0 Implementation Profile for Federation Interoperability. An evaluation of the requirements against the current CAS release is available here. It is recommended that you view, evaluate and comment on functionality that is currently either absent or marked questionable where verification is needed.
SAML Endpoints
The following CAS endpoints respond to supported SAML2 profiles:
/idp/error
/idp/profile/SAML2/Redirect/SSO
/idp/profile/SAML2/POST/SSO
/idp/profile/SAML2/POST-SimpleSign/SSO
/idp/profile/SAML2/POST/SLO
/idp/profile/SAML2/Redirect/SLO
/idp/profile/SAML2/Unsolicited/SSO
/idp/profile/SAML2/SOAP/ECP
/idp/profile/SAML2/SOAP/AttributeQuery
/idp/profile/SAML1/SOAP/ArtifactResolution
Metadata Management
Handling and storing SAML2 identity provider or service provider metadata can be done in a few ways. To learn more, please review this guide.
Configuration
Support is enabled by including the following dependency in the WAR overlay:
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-saml-idp</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-saml-idp:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-support-saml-idp"
}
You may also need to declare the following repository in your CAS overlay to be able to resolve dependencies:
1
2
3
4
5
6
repositories {
maven {
mavenContent { releasesOnly() }
url "https://build.shibboleth.net/maven/releases/"
}
}
The following settings and properties are available from the CAS configuration catalog:
cas.authn.saml-idp.core.entity-id=https://cas.example.org/idp
The SAML entity id for the deployment. This setting supports the Spring Expression Language. |