> On Dec 16, 2015, at 11:42 AM, mozandy <[email protected]> wrote: > > We have a Python Pylons web app that uses CAS 4.x for SSO, calls back to > serviceValidate to validate token. etc. and now we have a need to federate > with outside orgs using SAML 2.0. Was looking at Shibbolizing a CAS and > building a Shibboleth SP in front of CAS looking at this: > https://wiki.shibboleth.net/confluence/display/SHIB2/Shibbolize+a+CAS+server, > but so far don't have that working. Looks like CASShib is for an older > version of CAS, so I'm guessing I should leave that alone? Potentially I'm > thinking of using Asimba > (https://sourceforge.net/p/asimba/wiki/Quickstart%20Asimba%20Server%20Baseline/) > for testing and configuring IdPs that need to use our service. As a newbie > to SAML and CAS, it would be nice to hear from folks with experience if this > seems reasonable or I'm completely confused. Are there best practices for > setting up federated SAML 2.0 with CAS 4.1.x. What's the best approach to > take a CASified app and make it federated ? Thanks for any tips and guidance > :-)
Andy, I wrote that wiki page on Shibbolizing a CAS server a few years back. It can still be done today but it is pretty much a moot point anymore. The reasons I wrote the page is at the of writing I worked for an institution that was entirely Shibboleth based for its web SSO. My team was given an app that only supported the CAS protocol so I “fixed” that.. :-) Anyway there are any number of combinations that can be applied to your particular scenario going forward. Here are a few options in order of "implementation ease” a) continue to use CAS as your web login, and install shibboleth IdP that relies on CAS for authentication (see RemoteUser in shib docs) b) install Shibboleth v3.2.0 and use both the SAML and CAS protocol from one login infrastructure c) use my directions on the wiki page linked above to shib your CAS server (more work than you probably want) As for shibcas I think Unicon still supports that to an extent… That is just what I recall. HTH -------- thanks kevin.foote -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
