Migrating CAS clients to shib idp v3 cas service

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Monday, February 29, 2016 6:06 PM
> 
> I'm not sure I followed the internal-rewrite suggestion, but the session
> cookies issued by the IdP can be altered to a domain other than the literal
> server, so if your different URLs share a domain, that might work.

They both share the same domain (cpp.edu), but they are both top level (auth.cpp.edu, idp.cpp.edu), there is no subdomain. I wouldn't want to set the cookie path to just cpp.edu and allow the cookie to be sent to every single web server in our entire domain 8-/, so I don't think that would work.

> If I'm not mistaken, the CAS client config is basically two different URLs, right,
> the login URL and the validation URL? So you could leave CAS in place
> indefinitely until all the clients are migrated to point to the IdP, but the IdP
> would forward things along to CAS for authentication to itself until they were
> all moved, and then you'd drop the final CAS client on the IdP out of the mix
> and switch it to native authentication. I would guess that kind of conversation
> might take years though.

I think you mean continue to delegate authentication on idpv3 to CAS like we are currently doing on idpv2? That was suggested, but I really don't want to do that :(. I don't mind a little bit of minor configuration tweaking to do some URL rewriting or redirecting, but I really don't want to completely change the long-term desired behavior of the idp such as authentication configuration as part of a temporary migration <sigh>.

There are a fair number of the CAS authenticated services that we manage and that while probably difficult to coordinate I could possibly transition to the new idp during the same change window as when I deploy the new v3. Then I would just need to manage to convince my management that it was okay to allow the other ones to authenticate separately for some amount of time while we coordinated switching them over.

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768