1. JA-SIG CAS Enterprise Single Sign-On Scott Battaglia Application Developer Enterprise Systems & Services Rutgers, the State University of New Jersey Copyright Scott Battaglia 2006. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

2. Background Member of Architecture & Engineering Team Lead Developer for JA-SIG CAS

3. Agenda Brief Overview of CAS Rutgers before CAS Transition to CAS Where We’re at Now Why We Chose CAS

4. What is CAS? CAS is  Enterprise single sign on for the web  A trusted web application  A proxy authenticator

5. History of CAS CAS 1.0  Created by Yale University  Web Single Sign On  Easy to use CAS 2.0  Also produced by Yale University  Introduced Proxy authentication

6. History of CAS JA-SIG CAS 3.0  Became JA-SIG project in 2004  Jointly led by Yale and Rutgers  Goal was to make CAS flexible to meet local needs  100% compatible with CAS 2 protocol

7. Authentication at Rutgers Rutgers is a place of choice  Authentication via Kerberos  Authentication via LDAP  Authentication via RADIUS Multiple passwords  Kerberos password  PIN  Safeword  SecureId

8. Before CAS Multiple authentication paths Different credentials for different systems Re-inventing the wheel each time Inconsistent log in Users gave password to application Difficult to ensure consistent and proper handling of credentials

9. Transition to CAS Initiative to introduce portal to Rutgers Needs to aggregate content from various providers Needed secure way to access services on behalf of user without caching passwords Recognized need for web single sign on

10. Transition to CAS Identified several key areas to address:  Capacity planning  Is single sign on confusing?  Who can use CAS?  Convincing others to use CAS  24/7 availability

11. Where We’re at Now CAS is our enterprise level sign on Proxy authentication Protects our web services Java, PL/SQL, PHP, and ASP clients Uses LDAP for primary authentication Running on a Sun Fire V120 (UltraSPARC-IIe 648MHz) with 2GB of RAM Vending 20-30 tickets a minute

12. Why We Chose CAS Wide community deployment and support Open Source Easy to use Industry supported Large amount of clients Flexible to meet local needs

13. Your school goes here.

14. Many CAS Clients Acegi (for Java web-apps, esp. Spring) AuthCAS (Perl Apache module) PerlCAS phpCAS MOD_CAS PAM_CAS ISAPI filter PL/SQL

15. Many Supported Platforms

16. Applications distributed CASified Your Application Goes Here. BlueSocket (!)

17. Summary Roll out single sign on in a manageable way Easily integrated existing web applications Improve security by consolidating credentials handling Isolate primary authentication dependency