SSO-CAS Login Handler

[Caskey, Paul]

You may be interested in this plugin, which does what it sounds like you are trying to achieve:
https://github.com/Unicon/shib-cas-authenticator



From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of yanis aumont
Sent: Wednesday, August 01, 2012 4:58 AM
To: dev at shibboleth.net; Mehdi Hached
Subject: SSO-CAS Login Handler

Hi,

I'm working at RENATER (French NREN) at developing a new login handler for the IdP and I would like to have some clues or feedbacks on what I've already done.

Many French universities and higher education institutions all over the world use SSO-CAS as authentication system. Thus, as you may know, many of them who joined an academic federation run the Shibboleth IdP in conjunction with SSO-CAS (via the RemoteUser login handler). The handler I'm developing will allow them to be compatible with one of the most common features of SAML2 originally provided by Shibboleth IdP : forced authentication. This feature is quite often asked for by administrators.

This handler is inspired from both the RemoteUser login landler and the ExternalAuthnSystem login handler. It acts as an intermediate between the Authentication Engine and the filters provided by the SSO-CAS Client. It extends AbstractLoginHandler and provides a few methods allowing the enforcement of forced authentication through CAS.

When this handler's login() is called by the Authentication Engine, these methods examine if forced authentication is required. Then they act accordingly on CAS-related attributes of the request, and build the URL of the filter to which the request is to be forwarded. The RemoteUserAuthServlet is called after the SSO-CAS Client's filters to get the result of the authentication and return control to the Authentication Engine - just as it is done with the RemoteUser login handler.

Using this handler does not imply any modification on the SSO-CAS Client or server.

Since this handler represents only a few lines of code and does not affect any other functionality of the IdP, we think that it would be valuable to implement it directly in a more generic handler. I have seen that you plan to merge the RemoteUser and the ExternalAuthnSystem login handlers, and our code would fit well and easily in the result of the merging.

Thank you for any reaction,

Yanis Aumont.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120801/3079e90e/attachment.html