Leveraging CAS with Luminis
March 28, 2006
In SunGard Higher Education's Luminis product one of the many add-on packages you can install is CAS support. CAS is an acronym for Central Authentication Service. This WebISO solution is one of the most common in higher education. CAS was created originally by Yale, but ongoing support has been taken over by JA-SIG. When the CAS package is installed in Luminis, it makes Luminis act as a CAS authentication provider. Coupled with this built-in Luminis support, we use a CAS library called phpCAS that adds to the simplicity of deploying this within our environment.
Time and again, CAS has been proven an effective and simple way for us to quickly drop authentication ability into our homegrown PHP applications. Once a function was developed, this was easily reused across dozens of applications within a few short months. The ease of deployment made it easy to convince various developers to switch from custom authentication schemes.
In a PHP application on any of the servers in your environment you can do something like the following:
-
<?php
-
-
function casify()
-
{
-
// import phpCAS lib (http://esup-phpcas.sourceforge.net/)
-
include_once($GLOBALS['INCLUDES'].'/cas/CAS.php');
-
-
// initialize phpCAS
-
phpCAS::client(CAS_VERSION_2_0,'luminis.institution.edu',443,'cas/');
-
-
// check CAS authentication
-
phpCAS::forceAuthentication();
-
-
// at this step, the user has been authenticated by the CAS server
-
// and the user's login name can be read with phpCAS::getUser().
-
-
return phpCAS::getUser();
-
}
-
-
-
$username = casify();
-
-
// nothing past the execution of casify() would occur without acquiring a valid CAS ticket
-
-
?>
Note: the preceding code is an example. There is more sophisticated functionality that can be accomplished using CAS, this is merely a starting point for people interested in this WebISO technology.
Tags: cas, development, education, higher education, identity management, jasig, luminis, php, phpcas, security, sungard, sungard higher education, web development, yale, yalecas
Comments
4 Responses to “Leveraging CAS with Luminis”
Got something to say?
Are you confident that in exposing your CAS code you are not introducing any security holes for would be authenticators?
This isn’t exactly what we do in our environment. In fact what you see in the function I wrote is primarily a series of calls to phpCAS functions which are all documented on their site. There is a lot of additional complexity we’ve coded in around this. As I said in the post, this is “merely a starting point for people interested in this WebISO technology.”
[...] From NoSheep.net’s article: In SunGard Higher Education’s Luminis product one of the many add-on packages you can install is CAS support. CAS is an acronym for Central Authentication Service. This WebISO solution is one of the most common in higher education. CAS was created originally by Yale, but ongoing support has been taken over by JA-SIG. When the CAS package is installed in Luminis, it makes Luminis act as a CAS authentication provider. Coupled with this built-in Luminis support, we use a CAS library called phpCAS that adds to the simplicity of deploying this within our environment. [...]
[...] Until this point I had only though of Shibb as a solution for inter-organizational web-based single-sign on (Federated SSO or WebISO or WebSSO). I knew I could use Shibboleth internally to serve as my WebSSO, but we already have a hugely successful implementation of CAS in our environment. Additionally I haven’t been able to point at a killer application of the federated WebSSO ability. I knew this driver would be coming, but without immediate demand I was luke warm on Shibboleth. [...]