CASsystemer

CASsystemer, or Central Authentication Service systems, are identity and access management solutions that provide single sign-on across multiple applications. In a CAS deployment, a user authenticates once to a central CAS server and can access all registered services without re-entering credentials.

The Central Authentication Service originated in the early 2000s at Yale University and has evolved into an open standard maintained by the Apereo Foundation. Implementations vary, but most CAS deployments share a common workflow and ticket-based model.

Core workflow: A user attempting to open a protected service is redirected to the CAS login page. After a successful authentication, the CAS server issues a ticket-granting ticket and a service ticket for the requested service. The service validates the ticket with CAS and the user's session is established. The system can also support proxy tickets for back-end services.

Architecture and capabilities: A CAS setup typically includes a CAS server, a ticket registry (for tickets such as TGTs and service tickets), a service registry (list of relying applications), and authentication backends (LDAP, Active Directory, database). CAS protocols have evolved from the original CAS protocol (versions 1.x) to 2.x and 3.x, and modern deployments can also provide SAML 2.0, OAuth 2.0, or OpenID Connect tokens to clients.

Usage and security: CAS systems are common in universities and research institutions to centralize authentication and simplify policy enforcement. They are deployed on-premises or in the cloud and require proper TLS configuration, session management, and MFA integration to mitigate risks.