Authentication Service

[Cantor, Scott]

On 12/2/14, 4:59 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com> 
wrote:



>Is Authentication Service built-in from Shibboleth version 2.0? We have 
>an OpenLDAP store that currently maintains the credentials of our users. 
>We would like our Authentication Service to be highly available and 
>automatically handle failover.
> With the above requirements, can we use the built-in authentication 
>service or should I be using an external service such as Jasig CAS?

Neither Shibboleth nor CAS are an authentication service, they're web 
authentication front-ends to an existing authentication service. LDAP is 
not really an authentication service either, though people commonly misuse 
it as one. Kerberos, RSA SecurID, and Active Directory are examples of 
actual authentication services.

The authentication options supported by Shibboleth out of the box are 
documented in the wiki and amount to anything with a JAAS login module or 
anything a web server can do and pass an identity in from.

Nothing "automatically" handles failover, clustering is hard and imposes 
costs and trade-offs. The clustering options and alternatives in the IdP 
are also in the wiki.

-- Scott