First things first,
What is Single Sign-On?
: Wikipdedia has this definition for it.
CAS (Central Authentication System): Its a project started by Yale university to provide a trusted way for an application to authenticate a user (ref: The JA-SIG CAS Project)
I came across CAS when i was searching for a Single Sing-On framework for a project, i did find another similar project Java Open Single Sign-On Project (www.josso.org). And the reason why i choose CAS is its Proven track record. CAS has been successfully implemented in a lot of projects not to mention Yale University has been using it for a long time now (Ok you could have guessed that :p).
When i downloaded the source and deployed the web application that came with it, i thought the java cas-client would work just out of the box. Well it would have, if i had a valid server certificate for my tomcat server, compared to my self-signed certifcate to make tomcat work with SSL. Wasn’t too long until i realized what was causing the problem the class edu.yale.its.tp.cas.util.SecureURL (inside the Java Cas Client) that was downloaded from http://www.ja-sig.org/products/cas/client/javaclient/index.html which didn’t accept my self-signed certificate from the server. So i just went back and changed it
Everything after that went super smooth, not to mention trying to use CAS everywhere i could :p
I played around with it a bit and installed a simple LDAP Authentication handler for the CAS Server application, this is an extract from the file WEB-INF/deployerConfigContext.xml
<bean id=“ldapAuth” class=“org.tecnova.cas.authentication.handler.support.LDAPAuthenticationHandler”>
<property name=“providerUrl”>
<value>ldap://localhost:389</value>
</property>
<property name=“credentialQueryString”>
<value>cn=#username#,ou=Employees,dc=tecnova,dc=com</value>
</property>
</bean>
…
…
…
<property name=“authenticationHandlers”>
<list>
<bean class = “org.jasig.cas.authentication.handler.support.
HttpBasedServiceCredentialsAuthenticationHandler” />
…
…
<ref local=“ldapAuth” />
</list>
</property>
and to enable CAS authentication on the client application all we need are the following entries in the WEB-INF/web.xml of the Client web application.
<web-app>
…
…
<filter>
<filter-name>CAS Filter</filter-name>
<filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
<param-value>https://localhost/cas/login</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
<param-value>https://localhost/cas/proxyValidate</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
<param-value>localhost</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CAS Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
…
…
</web-app>
Remember my tomcat is set to listen on port 80 and has SSL enabled, CAS won’t work without SSL enabled on your app server.
For rest of the details on what I did I have attached a sample Server and Client web application. Which can be downloaded here.