CAS/shib integration

[Paul B. Henson]

We've had a shibboleth deployment for quite some time, and recently deployed CAS per the request of our applications group as they wanted to use it with uportal. Management has decided, for better or worse, to make CAS the official SSO now and wants us to delegate shib authentication to CAS.

I'm tentatively leaning towards implementing Unicon's shib-cas-authenticator module, it seems the most technically superior choice (modulo the critical security flaw in their initial release :) ). Just wondering if anybody looked at that and ended up going with the basic remote user method instead, and if so, why?

For those that did go with shib-cas-authenticator, is there any easy way to externalize the configuration? One thing I really appreciate about the shibboleth package is that all of the configuration is stored externally in the file system, not bundled in the WAR file, which makes it much easier to integrate into an enterprise management system. Unfortunately, that seems to be the exception in the java webapps world :(, and shib-cas-authenticator like most webapps wants to embed all of the configuration in XML files within the actual WAR file when it is built, which is exceedingly annoying. I'd like to deploy it the same as I do shibboleth, building one WAR file installed on all systems, production, development, or test, with the specifics of the configuration dropped in by configuration management into the file system. I think there's a way to make it load an external properties file and then use variables in the internal xml rather than hardcoded configuration, but I with no shame admit my java ignorance :), and if anybody's already done that I'd appreciate the details. Otherwise, I guess I'll go with what I ended up doing with CAS itself, a custom post install script in the package that replaces the xml files in the WAR with ones from the local filesystem before copying it into the webapps directory <sigh>, what a kludge.

Thanks...


--
Paul B. Henson  |  (909) 979-6361  |  http://www.csupomona.edu/~henson/
Operating Systems and Network Analyst  |  henson at csupomona.edu
California State Polytechnic University  |  Pomona CA 91768