In the university world, the Apereo [formerly Jasig] CAS system is a common way to do Single Sign On for large suites of web applications. With CAS, the user only ever enters their password on the authentication server -- individual applications validate a one-time ticket instead of seeing the user's password. This is a major security win when dealing with applications developed by many in-house groups and vendors as none of the applications ever have access to the users' passwords.
There are numerous CAS-client libraries available for most programming environments and built-in CAS support is becoming more common for applications used or sold to universities. In addition to the main "Jasig CAS Server" there are also several additional servers available, including the Ruby CAS Server and a module for Drupal that can act as a CAS server for authenticating additional applications against the Drupal database.
The Jasig CAS Server itself is written in Java and can be backed by any number of authentication handlers, including:
- OAuth 1.0/2.0, OpenID
- SPNEGO (Windows)
- Trusted (REMOTE_USER)
- X.509 (client SSL certificate)
The Jasig CAS server can act as an authentication source for application via a number of different protocols used for Single Sign On:
- CAS protocol 1/2/3
- SAML protocol 1.1/2.0
- OAuth protocol
- OpenId protocol
It can even be used as the authentication behind a Shibboleth provider or use a Shibboleth client as an authentication back-end.
Note: the Jasig organization is merging with the Apereo organization, so some urls might change in the future.