Can a single SP front multiple disparate applications?

[Christopher Bongaarts]

On 9/6/2013 1:50 PM, Bryan E. Wooten wrote:

> Is it feasible to move them off CAS and behind one SP?

Don't bother - set up your IdP to auth via CAS (or set up your CAS 
server to auth via your IdP!) and let them coexist merrily.

> You confirmed my thoughts on this. I asked because the question came up in meeting today and I didn't have definitive answer. The U is considering a policy all IT purchased software be require to use Incommon / Shib and we were wondering  if this policy would extend to in house developed applications.
>
> While I agree with Scott philosophically about CAS (api Client integration) vs Shib the unfortunate reality is that CAS is much easier for in house developer's to implement  and results in less infrastructure/servers for my dept to maintain (ie many SPs).

It should be possible to construct an environment using Shib that is 
developer-friendly, without needing lots of extra servers.  Would need 
to know more details to make specific recommendations.

> Another reality is that we are resource thin and asking the developers of these 100s of applications to move off CAS and onto Shib would take years.

We set  a deadline to shut off our old SSO system to force apps to move 
to Shib.   The deadline passed a couple years ago and the old system is 
still in use ;)

My original transition strategy was to enable SSO between our old system 
and Shib, and allow things to move over naturally over an extended 
period (no new apps on the old system), and is what I'd recommend to 
others contemplating this path.

> The problem with the mod_auth_cas (mod_cas?) CAS client is that it does not support CAS attribute release which more and applications are requesting. Many of the attributes they desire are not part of eduPerson otherwise I would encourage them to use Shib. Though I suppose we could configure our IDP release custom attributes.

By all means, give those apps local attributes.  Or least give them a 
sufficiently unique id that they can use to turn around and query LDAP 
or a database to pick up the rest of the data.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%