1. CAS and Web Single Sign-on at UConn

2. Preview What authentication is Authentication systems at UConn CAS
What is does
How it works
Implementing CAS with Web Applications

3. What authentication is
Authenticate identity using a secret (password)
Authentication (AuthN) - Authorization (AuthZ)
Problem when AuthN=AuthZ

4. Authentication at UConn
Authentication system stores NetID and password
One NetID and password for all authentication.
Two parallel authentication systems
Active Directory
MIT Kerberos
Password sync and NetID
LDAP

5. Single Sign-On One login provides access to many systems. Advantages
User convenience
Password security
Single Sign-On Systems
Kerberos (Active Directory)
Not easily integrated with Web browsing

6. Web Single Sign-On Designed for Web browsing Choices CAS (1997?)
PubCookie (1999)
Shibboleth (2000)
CoSign (2002)
OpenID (2005)

7. Single Sign-On with CAS Step 1

8. Single Sign-On with CAS Step 2

9. Single Sign-On with CAS Step 3

10. How CAS works The players
User
Web Server
CAS Server
Kerberos*

11. How CAS works Cookies Cookies keep state information CAS client cookie
Tells client that user is logged in.
CAS server cookie
Tells CAS server that user has authenticated.
Both cookies last until the browser is closed.

12. How CAS works Request to Web Server
User requests page protected by CAS client
CAS client checks for CAS client cookie
If cookie is found, user is allowed to connect.
If no cookie, redirect user to CAS server …
guestreg.uconn.edu/cgi-bin/pa_admin.py

13. How CAS works Connection to CAS Server
User connects to CAS server.
CAS checks for CAS server cookie.
If not found, CAS server present login form.
User enters NetID and password.
If invalid NetID and password*, resend login.
If valid NetID and password, redirect user back to Web server with ticket.
j49xSASbuXJUjX9PltOqINab7va79Dg4TK3- 20

14. How CAS works Second Time to the Web Server
User sends ticket to the Web Server
Web Server checks ticket with CAS server
If valid
CAS server returns NetID
Web server delivers page and CAS client cookie to user.
If invalid
CAS server returns error
Web server delivers error page to user.

15. The Single Sign-Off problem
There are two cookies: the CAS client and CAS server cookies.
If you have a CAS server cookie, login is automatic.
Therefore, a Web service cannot log you out as long as you have a CAS server cookie.
To be fully logged out, you need to remove both the CAS server cookie and all the CAS client cookies.
CAS 3.0 implements a Single Sign-Off method.
Current best Single Sign-Off is to close your browser - this removes all CAS cookies.

16. Implementing CAS Web apps
CAS supported by JASIG
Official CAS clients
Apache Mod-auth-cas
appears to Web app like Basic Auth.
PHPCas
CAS Client for Java 3.0, 3.1
Unofficial CAS clients
Pycas
Ruby on Rails
Perl
see sig.org/wiki/display/CASC/Home

17. More Information Official home for CAS http://www.jasig.org/cas
CAS at UConn
see CAS link.