"shib-cas-authenticator" bridge

[Peter Schober]

* W.Alphonse HAROUNY <wharouny at gmail.com> [2013-04-12 13:25]:
> After googling on the net, I found the plugin "shib-cas-authenticator"
> https://github.com/Unicon/shib-cas-authenticator .

You should probably ask the author any questions about his code.
I also have no idea about CAS.

> 1/ Does the user fullfill his credentiels in the CAS login page ?

Yes, unless there's an active CAS SSO session, I would assume.

>     Does the validated SSO session by this plugin share the same CAS SSO
> session ?

No idea what any of that means. Usually you wouldn't have SSO enabled
in the Shibboleth IdP when it's delegating authentication to some
other SSO system which provides, well, SSO.

> 2/ If CAS validates the credentials towards the users datastore, then the
> plugin will give back the "RemoteUser" to Shibboleth IDP.
>     As Shibboleth IDP is driving the authentication kinematic flow, then it
> will push the "RemoteUser" to SaaS application, instead of pushing a
> SAMLArt, like it was the case with CAS.
>     Is it right ?

No. From what I can tell (and what you already stated above) all this
plugin seems to do is delegate authentication of the subject to CAS.
The rest is all SAML. What and how Shibboleth (as SAML IdP) sends
anything anywhere is completely up to how you configure the IdP.

> 3/ There is no Shibolleth-SP in the above solution, may a Shib-IDP
> release attributes to the SaaS application via the browser ?

In your scenarion the SaaS application /is/ the SAML SP (whether or
not it's running the Shibboleth SP software, which is unlikely).

>     Or is it mandatory that Shib-ID (Attribute Authority) releases
> attributes directly to Shib-SP (Attribute requester) ?

Neither the Shibboleth software not the SAML specifications make such
a mandate. Whether your deployment scenarion requries that I can't say
(but with SaaS/hosted applications that's an unlikely requirement).
-peter