IdP v2 to v3 migration success story

[Paul B. Henson]

On Mon, Jul 13, 2015 at 01:21:25PM +0000, Marvin Addison wrote:

> It's a matter of gain and loss. The most notable functional loss would be
> support for protocols like OAuth and OpenID. There are also a lot more

We don't currently use those, and I'm not aware of any short to mid term
plans to, so that's not much of a loss for us.

> integration components for Jasig CAS that aren't available in the IdP,
> mostly in the area of storage backends (e.g. Ehcache, Hazelcast). Those are
> admittedly fairly easy to develop, and it's simply a matter of time,

It sounds like Unicon is working on a Hazelcast-based storage engine for
idp 3, which would be pretty cool. We've been very happy with their
Hazelcast ticket registry for CAS which provides fault tolerance that
the memcache implementation does not, and it's been rock solid so far.

> There are a number of notable gains in the IdP generally that the CAS
> protocol support benefits from: attribute engine, reloadable services, ease
> of upgrades.

I started with CAS 3.5.x, so the upgrades so far haven't been too
painful :), as I haven't looked very heavily at CAS 4 yet. I've been
waiting for CAS 4.1 before putting any time into it, although now I'm
thinking I might look at the CAS support in the idp as a possible
alternative path.

> There are other differences that we could discuss, but the above are most
> important in my view as a deployer. Let me know if there are any
> capabilities in particular that you'd like to compare and contrast in
> further detail.

Mostly one I brought up in the sibling thread on the CAS mailing list -
multifactor authentication support. I know that both the shib idp and
CAS have some level of multifactor auth support, whether natively or via
extensions. We don't currently use multifactor, but that is definitely
something that's on the short to mid-term list, so support for it and
interoperability would be important. Right now we have idp 2
authentication delegated to CAS, and I don't see the powers that be
accepting splitting it apart again and having two "single" sign on
systems. So we can either upgrade to CAS 4.1 and idp 3 continuing to
delegate idp auth to CAS (I haven't looked at it yet, but I know Unicon
has something for idp 3 corresponding to their idp 2 implementation
we're currently using) or upgrade to idp 3 using its authentication
mechanisms and using its native CAS support for our CAS systems.

I apologize that I'm not familiar in detail with MFA in either a CAS or
idp context at this point, but I'd be curious which of those options
would likely lead to the best support? Will the idp MFA mechanisms work
for the CAS protocol? If idp authentication is delegated to a CAS
server, would the CAS MFA mechanisms be available to the idp for SAML
clients?

Thanks...

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768