CAS/shib integration

[Paul B. Henson]

> From: Peter Schober
> Sent: Thursday, January 23, 2014 12:47 AM
>
> RemoteUser is quicker and easier to setup (the IDP even defaults to
> it, so any setup happens outside Shib). Other than that it's main
> drawback seems to be the lack of support for forceAuthn and isPassive
> (if those ever become important to your SAML 2.0 SPs).

We're not currently using either, but I could see forced authentication being useful in the future, which is why I'm leaning towards setting up the more complicated one now rather than going the simple way and having to retool at some point.