<div>Hi all,</div><div><br></div><div>In our company, we have capitalized on a CAS server and its working very well.</div><div>Recently, we had to integrate a SaaS application into our SSO system, mainly for authentication.</div>
<div><br></div><div>Unfortunately, the kinematic flow imposed by CAS was not compatible with the kinematic flow expected by the SaaS application.</div><div>Actulally the SaaS application was not fully SAML compliant. Its was not able to deal correclty with the "SAMLArt" command generated by CAS.</div>
<div><br></div><div>After googling on the net, I found the plugin "shib-cas-authenticator" <a href="https://github.com/Unicon/shib-cas-authenticator">https://github.com/Unicon/shib-cas-authenticator</a> .</div><div>
It's modules ("idp-ca-invoker" and "cas-authentication-facade") are located between Shibboleth IDP and CAS.</div><div>It delegates authentication to the CAS server.</div><div><br></div><div>1/ Does the user fullfill his credentiels in the CAS login page ?</div>
<div> Does the validated SSO session by this plugin share the same CAS SSO session ? </div><div><br></div><div>2/ If CAS validates the credentials towards the users datastore, then the plugin will give back the "RemoteUser" to Shibboleth IDP.</div>
<div> As Shibboleth IDP is driving the authentication kinematic flow, then it will push the "RemoteUser" to SaaS application, instead of pushing a SAMLArt, like it was the case with CAS. </div><div> Is it right ?</div>
<div><br></div><div>3/ There is no Shibolleth-SP in the above solution, may a Shib-IDP release attributes to the SaaS application via the browser ?</div><div> Or is it mandatory that Shib-ID (Attribute Authority) releases attributes directly to Shib-SP (Attribute requester) ?</div>
<div><br></div><div>Thank you in advance.</div><div><br></div><div>Alf.</div><div><br></div><div><br></div>