CAS Integration Module for Shibboleth IdP

[Marvin Addison]

I am planning an R&D project on a CAS integration module for the Shib
IdPv2 sufficient to allow existing CAS clients to leverage the IdP as
a CAS server. A putative CAS-enabled IdP would allow us to consolidate
federated SSO (Shib) and institutional SSO (CAS) into a single product
to reduce engineering and support costs for our institution. I can
imagine this work would be of interest to other institutions that
deploy and support both CAS and Shib.

A cursory review of IdPv2 source suggests that I could leverage
ProfileHandlers to examine requests for signs of CAS protocol
behavior; either via URI or request parameters (though the IdP appears
to assume URI-driven behavior by default). That provides an entry
point to drive CAS-specific behavior. It remains to be determined how
to maintain state, which is a core concern of the Jasig CAS server,
but I am hopeful there is a straightforward solution. If nothing else
one could port some of the existing Jasig CAS storage layer.

I intend to begin work in March and finish by summer. The deliverable
is a proof-of-concept integration module that provides for CAS single
sign-on over CAS 2.0 and SAML 1.1 as well as single log-out. If the
proof of concept is promising, I am interested in collaborating more
closely to contribute this module into the IdPv3 as a bundled module
or blessed third-party extension.

I would sincerely appreciate your feedback on the proposal and any
implementation pointers/caveats you may have.

Kindly,
Marvin S. Addison
Middleware Services
Virginia Tech