3
votes

I have an existing CAS4 instance that is in use for SSO across several web applications using the CAS protocol. CAS4 and later CAS versions, including CAS5, support other SSO protocols as well. CAS4 has support for SAML, OAuth2 and OpenID 2.0. CAS5 has support for OpenID Connect, etc.

I am wondering if one application authenticates with CAS via the CAS Protocol and a second subsequent application requests access via SAML or OAuth2 if the second application will be prompted to login, i.e. defeating the "Single Sign On" feature/capability?

I would really hope that the "Single Sign On" pseudo session spans different protocols. My worry is that it does not.

1
Apereo CAS Website: apereo.org/projects/casRyan R.

1 Answers

2
votes

CAS4 has support for SAML, OAuth2 and OpenID 2.0. CAS5 has support for OpenID Connect, etc.

Let's be slightly more accurate that CAS4 has basic support for SAML1.1 and OAuth2 and its SAML2 support is limited only to handling an integration with Google Apps. Some have managed to extend it beyond that capability and turn it into a more general-purpose SAML2 integration strategy

CAS5 on the other hand as you note has support for SAML2 and OpenID Connect and a more improved version of OAuth2. The CAS protocol and related REST API implementations also gain quite a number of improvements in the way of working with JWTs as service tickets, etc.

I am wondering if one application authenticates with CAS via the CAS Protocol and a second subsequent application requests access via SAMPL or OAuth2 if the second application will be prompted to login, i.e. defeating the "Single Sign On" feature/capability?

No. That is the purpose of Single Sign-On. Regardless of what protocol you use, SSO/Authentication will continue to work fine because these are different subsystems. The thing that speaks a protocol language and the thing that validates credentials and the thing that creates and manages an SSO session all are very much independent of each other. If you find the opposite to be true in practice, that is a defect that needs a diagnosis.

I recommend you take a look at this blog post: https://apereo.github.io/2018/02/26/cas-delegation-protocols/