What is this?
CAS (Central Authentication Service) is an enterprise multilingual identity provider and single sign-on server for the web: an open-source Java platform for centralizing authentication and authorization.
CAS (Central Authentication Service) is an enterprise multilingual identity provider and single sign-on server for the web: an open-source Java platform for centralizing authentication and authorization.Is this a library I add to my app's code, or a separate server I run?A server you deploy, not a library: your applications redirect users to CAS to log in, and it asserts their identity back to each app. This repo is that server implementation — nothing gets added into your app's codebase.
A server you deploy, not a library: your applications redirect users to CAS to log in, and it asserts their identity back to each app. This repo is that server implementation — nothing gets added into your app's codebase.How do I actually get a CAS server up and running?Build a WAR using the recommended WAR Overlay method and run it on Apache Tomcat or Jetty, or as a Docker container. Cloning this codebase is only needed if you want to contribute to CAS itself.
Build a WAR using the recommended WAR Overlay method and run it on Apache Tomcat or Jetty, or as a Docker container. Cloning this codebase is only needed if you want to contribute to CAS itself.Where do the usernames and passwords come from — does it force a particular user database on me?Nothing is forced: it can authenticate against JAAS, LDAP, relational databases, X.509, Radius, SPNEGO, JWT, MongoDB, Apache Cassandra and more, or delegate login to external identity providers over SAML2, OpenID Connect and OAuth.
Nothing is forced: it can authenticate against JAAS, LDAP, relational databases, X.509, Radius, SPNEGO, JWT, MongoDB, Apache Cassandra and more, or delegate login to external identity providers over SAML2, OpenID Connect and OAuth.How much work is it to keep running day to day — is there a catch?You operate the whole thing: register every application, run and scale the servers, and handle upgrades yourself. The software is free, but ongoing commercial support from Apereo is a paid extra.
You operate the whole thing: register every application, run and scale the servers, and handle upgrades yourself. The software is free, but ongoing commercial support from Apereo is a paid extra.Would a solo dev realistically run this for a small project, or is it built for organizations?It is built for organizations — companies, universities, anyone with many web apps that should share one login. A small personal project rarely justifies hosting a full identity platform.
It is built for organizations — companies, universities, anyone with many web apps that should share one login. A small personal project rarely justifies hosting a full identity platform.Where can the server run — am I locked into Linux?It runs wherever Java runs — it is packaged for Apache Tomcat and Jetty and as Docker containers — so Linux servers are the norm, though not required. End users only ever meet it in a browser.
It runs wherever Java runs — it is packaged for Apache Tomcat and Jetty and as Docker containers — so Linux servers are the norm, though not required. End users only ever meet it in a browser.Is it really free to use for a commercial product?Yes — 100% free open source under Apache v2, with every release available at no cost, including for companies. Only optional commercial support from Apereo costs money.
Yes — 100% free open source under Apache v2, with every release available at no cost, including for companies. Only optional commercial support from Apereo costs money.Which SSO protocols can my applications use to talk to it?The full enterprise set: CAS v1/v2/v3, SAML v1 and v2, OAuth v2, OpenID Connect, and WS-Federation Passive Requester.
The full enterprise set: CAS v1/v2/v3, SAML v1 and v2, OAuth v2, OpenID Connect, and WS-Federation Passive Requester.Can it require a second factor, like Duo or YubiKey?Yes — multifactor authentication is built in, with support for Duo Security, Simple MFA, YubiKey, RSA, Google Authenticator, WebAuthn FIDO2 and more.
Yes — multifactor authentication is built in, with support for Duo Security, Simple MFA, YubiKey, RSA, Google Authenticator, WebAuthn FIDO2 and more.Does it handle authorization too, or just login?Authorization is covered as well: policies can be enforced via Heimdall, OpenFGA, OPA, ABAC rules, time/date constraints, REST, or Internet2's Grouper.
Authorization is covered as well: policies can be enforced via Heimdall, OpenFGA, OPA, ABAC rules, time/date constraints, REST, or Internet2's Grouper.Can I run several instances for high availability?Yes — clustered HA deployments are a supported scenario, with shared state in Hazelcast, JPA, Memcached, Apache Ignite, MongoDB, Redis, DynamoDB and more.
Yes — clustered HA deployments are a supported scenario, with shared state in Hazelcast, JPA, Memcached, Apache Ignite, MongoDB, Redis, DynamoDB and more.What are similar projects?casdoor, authentik, zitadel, authelia, logto, django-allauth, dex, keycloak
casdoor, authentik, zitadel, authelia, logto, django-allauth, dex, keycloakWhich topics is it in?webauthn, mfa, openid-connect, saml, iam, ldap, springboot, spring-cloud, authorization, spring, spring-boot, sso
webauthn, mfa, openid-connect, saml, iam, ldap, springboot, spring-cloud, authorization, spring, spring-boot, sso