Introducing JA-SIG Central Authentication Service 3.0 Scott Battaglia Rutgers, the State University of New Jersey

Outline What is CAS? History of CAS  CAS 1.x  CAS 2.x Introducing CAS 3  Development Process/Developers  Design Goals  Why build CAS 3? Advanced CAS 3 Usage  Clustering/Load Balancing  Accepting Multiple Credential Types  SAML Support The Future Helping with CAS Development

What is CAS? CAS is…  Single sign on for the web  A trusted intermediary  A proxy authenticator to back-end services

History of CAS CAS 1.x CAS 2.x

History of CAS: CAS 1.x Original version released by Yale University Offered single sign on for the web Consisted of servlets and JSP pages

History of CAS: CAS 2 Also developed at Yale University Introduced concept of proxy authentication to CAS Simple: 6 servlets and fewer than 10 JSPs Extremely popular Large User Community

Introducing CAS 3.0

CAS 3.0: Why Build CAS 3? CAS 2.0 was an excellent project CAS 2.0 was easy to use CAS 2.0 was not easy to extend or augment with local requirements CAS 3.0 attempts to solve the last problem!

CAS 3.0: Why Build CAS 3? Making changes to CAS 2.0 generally requires forking the code base Adding new features may require a lot of copying and pasting which may get out of sync with core code base.

CAS 3.0: Why Build CAS 3? CAS 3 offers…  CAS 2 compliance out of the box  Unit/Integration Tests and Compliance Tests  Proper domain model  Revamped architecture  Support for well-known modifications

CAS 3.0: Design Goals First and foremost CAS3 will be Flexible, Extensible and Elegant. CAS3 will maintain backward compatibility with CAS 2.0 and CAS 1.0 protocols while providing extension points for well-known modifications and new features such as support for Web Services, SAML and Shibboleth. CAS Clients written for older versions of CAS will work with CAS3 without modification.

CAS 3.0: Development Process Started as a Yale/Rutgers collaboration Became JA-SIG Project in December 2004 JA-SIG project makes it open-source Available in public JA-SIG CVS, nightly builds on Clearinghouse machines, etc.

CAS 3.0: Development Team Yale University  Susan Bramhall  Howard Gilbert  Drew Mazurek  Andy Newman  Andrew Petro Rutgers, the State University of New Jersey  Scott Battaglia  Dmitriy Kopylenko  Bill Thompson

CAS 2 Compliance In terms of protocol, drop in replacement for CAS 2.0 Requires no modifications to client applications Includes adaptor to allow plugging in CAS 2 PasswordHandler into CAS 3 architecture

Unit/Integration/Compliance Tests Unit and Integration Tests coverage of major components  Utilizes JUnit, Clover  According to Clover, 99.5% test coverage  Allows us to refactor with confidence! Compliance Tests  Run against live server  Test compliance to CAS 2 specification  Currently 48 tests

Proper Domain Model Major Breakthrough: Only Two Types of Tickets  Ticket Granting Ticket  Service Tickets Domain logic belongs with Domain Objects  Example: A ticket can determine if its expired  Simplifies implementations of supporting pieces

Revamped Architecture Built on popular open-source frameworks  Spring Framework  Quartz  xFire  Jakarta Commons  Log4j  Maven Design Philosophy: don’t reinvent the wheel

Revamped Architecture Loose coupling of components  Via Dependency Injection  Declarative configuration via XML files Coding to interfaces  Swap implementations to suite needs  Implementations adhere to contract  Example: TicketRegistry

Revamped Architecture Uses Design Patterns  Patterns allow for a common understanding  Example: Template Design Pattern Layered Architecture  Separation of UI concerns from business concerns  Allows for better re-use of code  Example: Web Tier vs. Web Service

Revamped Architecture Use of AOP to separate cross-cutting concerns for business logic  Allows for major additions to functionality without modifying core code  Example: auditing Use of Spring Workflow allows for declarative reconfiguration of Login process

Support for Well-Known Modifications Gathered list from current and future (potential) CAS deployers CAS 3 includes extensions points for well- known modifications CAS 3 (via Spring) supports using AOP to introduce modifications

Support for Well-Known Modifications Audit Trail Modification (identified by CalPoly) Services Whitelist (identified by Columbia and University of Delaware) Additional Principal (and Authentication) Attributes (Rutgers, others) Ticket Statistics (Yale)

Support for Well-Known Modifications Audit Trail Modification  CAS supports publishing of events  EventListener listens for events  Deployers can code and register “EventHandlers” that allow them to log particular events

Support for Well-Known Modifications Attributes  CAS supports plugging in PrincipalResolvers and MetaDataPopulators  Allow to attach attributes to principals (i.e. hair color or employee type)  Attach attributes to Authentication (i.e. safeword authentication)  Can customize view to pass back attributes.

Support for Well-Known Modifications Ticket Statistics  Exposed via JMX  Tell how many of each ticket type were vended  Tell how many tickets of each type were vended per second

Advanced CAS 3 Usage

Clustering/Load Balancing CAS All CAS Domain objects are serializable Tickets are only stored in TicketRegistry TicketRegistry is interface Implement JGroups TicketRegistry (David Stacey)

Accepting Multiple Credential Types Web Login defined by workflow Dartmouth identified need to have augmented login workflow Need to check for Client Certificate before displaying login form

SAML Support Standard XML-based framework Used to create and exchange info amongst online partners CAS can offer alternatives to the CAS 2 Protocol views One alternative is a SAML response

The Future of CAS

Advanced SAML Support  Support for both SAML request and responses Shibboleth Support  Requires advanced SAML support  Allow CAS to speak to Shibboleth Who knows what else…  current architecture allows for many possibilities

The Future of CAS Already working on a (and beyond)  XMLBeans view  More robust registry cleaners  Increased compatibility testing  Support for Single Sign out (requires new clients)

Helping with CAS 3.0 Development What can YOU do to help?  Look at what CAS 3 has to offer  Use CAS 3  Report bugs/feature requests/etc to the development list  Give your extensions back to the community  Share your experiences using CAS with the community  Join the CAS mailing list

Questions or comments?