Adding Shibboleth to CAS

[Cantor, Scott]

On 3/1/13 3:31 PM, "Stein, Eric" <steine at locustec.com> wrote:

>Okay, so I'm playing around with what I think is the third option - using
>shib-cas-authenticator.

No, I don't believe that would be what I had third.

> As I understand it, I can protect applications using shibboleth2.xml.
>Users trying to access a protected application should be redirected to
>CAS for authentication. Users who are already authenticated in my
>federation will not have to reauthenticate and will be allowed to hit the
>protected application.

That would be what I had as option 2, essentially running the SP instead
of CAS, making your CAS system act as the authenticator for an IdP for
your users, and then having the customer act as a second IdP option.

>I'll eventually be fronting Tomcat with HTTPD, but right now I'm just
>running Tomcat. Where do I put the shibboleth2.xml file? Or do I need to
>get Apache set up first?

The latter. The SP is not in Java, it requires Apache, IIS, or FastCGI (or
Sun Java Server/Netscape/SunOne/WhoCaresNobodyUsesItAnymore).

What's behind those options can be anything.

If you would like a pure Java option to do the SAML, you would have to
explore other solutions (but the SAML/CAS hand off could still be done in
the manner you were evaluating).

-- Scott