Moving away from kerberos auth

[Peter Schober]

* Morris, Andi <amorris at cardiffmet.ac.uk> [2016-07-05 14:06]:
> We want to upgrade the IdP to version 3, and if possible move it
> away from the Kerberos authentication.

What do you intend to delpoy instead of Windows Integrated
Authentication? Nothing, i.e. forms-based login even from managed PCs?

> Shibboleth is currently the only system we run here that is
> authentication with Kerberos

The only server, I'm guessing, since all your managed PCs are still
depending on Kerberos, right?
It doesn't have to the the Shibboleth IDP, it can probably also be a
CAS IDP that uses Kerberos. But having one server use Kerberos for
things like supporting Windows Integrated Authentication is still
useful. I'm sure a mature SAML IDP deployment will be "the only
system" with regards to quite a few other aspects as well? That alone
doesn't seem like a reason to stop using Kerberos on the server?

> (we're keen to use CAS for its single sign on possibilities, and
> because we can run ADFS and Shibboleth alongside each other).

Why would you want to run 3 SSO systems when you could only run 1 or
2?  And with CAS' "single sign on possibilities" you're referring to
it's proxying and n-tier support, e.g. PAM modules? Have you checked
whether the CAS support in the Shibboleth IDP is sufficient to supoprt
the CAS clients you intend to deploy?
-peter