Apereo CAS

CAS allows deployers to switch themes based on different services. This enables scenarios such as providing distinct login screens for different user groups (e.g., staff vs. students) or applying different layouts based on environmental factors (e.g., day vs. night modes).

Customization can be achieved through several different mechanisms depending on your requirements:

• Static Themes: Fixed theme configurations.
• Themed Views: Customizing specific views.
• Theme Collections: Managing groups of themes.
• Groovy: Using Groovy scripts for dynamic theme selection logic.
• REST: Using RESTful services to drive theme selection.

Branding the CAS User Interface (UI) is achieved through three primary methods:

1. CSS Stylesheets: Editing stylesheets to change the visual appearance.
2. Views: Modifying a collection of simple HTML include files (known as views) to change structure.
3. JavaScript/Text: Optionally adding JavaScript effects or modifying the displayed text within these views.

For more specific implementation details, refer to the dedicated guides for CSS & JavaScript, Views, Localization, and Themes.

CAS supports a wide variety of authentication methods to verify user identities. You can configure these strategies based on your identity provider (IdP) or storage mechanism.

Key authentication categories include:

• Directory Services: LDAP, Apache Cassandra, Apache Syncope.
• Database/SQL: JDBC (with support for Query, Bind, Search, Encode, and Stored Procedures).
• Certificate-based: X.509 (including WebServer configuration, Principal Resolution, and CRL fetching).
• Modern Protocols/Tokens: JWT (JSON Web Tokens), SPNEGO, OAuth2/OIDC-related flows (Okta, Microsoft Entra/Azure AD, AWS Cognito).
• Cloud/SaaS: AWS Cloud Directory, Okta, Microsoft Entra.
• Legacy/Other: RADIUS, Groovy-based custom logic, QR Code, Redis, MongoDB.
• Specialized: Passwordless authentication, Adaptive authentication, and Remote/Trusted authentication.

CAS acts as a multilingual platform supporting a wide variety of authentication protocols. Depending on your deployment and enabled plugins, you can use the following protocols to interact with the CAS server:

• CAS Protocol: The native CAS protocol.
• OAuth2: For authorization and delegated access.
• OpenID Connect (OIDC): An identity layer on top of OAuth2.
• WS Federation: Web Services Federation.
• SAML1: Security Assertion Markup Language version 1.
• SAML2: Security Assertion Markup Language version 2.
• REST Protocol: For interacting with CAS via RESTful endpoints.

CAS supports multiple notification channels for security alerts or user interactions:

• Email: Strategies include Default, SendGrid, Microsoft Entra, Amazon SES, Mailjet, Mailgun, or Custom implementations.
• SMS: Support for Groovy, REST, Twilio, Mailjet, TextMagic, Clickatell, Amazon SNS, Nexmo, or Custom implementations.
• Phone Calls: Integration with Twilio or Custom implementations.
• Push Notifications: Support for Google Firebase (FCM), Apple Push Notification (APN), Slack, or Custom implementations.

CAS provides different strategies for securing configuration properties and sensitive resource contents. Depending on your infrastructure, you should choose one of the following security policies:

• CAS Policy: Uses CAS-specific mechanisms for securing properties.
• Spring Cloud Policy: Leverages Spring Cloud's configuration security features.
• Vault Policy: Integrates with HashiCorp Vault to manage and secure sensitive configuration data.

CAS provides various integration points for extending its functionality:

• Scripting: Using Apache Groovy for logic.
• Identity & Provisioning: Integration with SAML2 Service Providers, SCIM, Apache Syncope, and Okta.
• Security & Analytics: Google reCAPTCHA and Google Analytics.
• GeoTracking: Authentication requests can be enriched with location data via Azure Maps, Google Maps, Maxmind, Groovy, or IP GeoLocation.
• Cloud & Infrastructure: AWS Integration and ACME.
• Management & Monitoring: Swagger (API docs), JMX, and JDBC Drivers.

CAS supports built-in service discovery options to facilitate locating nodes for load balancing and failover in microservice-based architectures. This is essential for high availability environments.

Supported discovery services include:

• Consul Server Discovery Service: Uses HashiCorp Consul for service discovery, configuration, and health checking.
• Eureka Server Discovery Service: Uses Spring Cloud Netflix Eureka, a REST-based service for locating middle-tier servers for load balancing and failover.

The CAS WAR Overlay Initializr is a tool that dynamically generates CAS WAR overlay projects based on your specific requirements. Instead of manually configuring a static Gradle-based project, you can use the Initializr's API to pull in only the modules and dependencies needed for your deployment. This is particularly useful for automating upgrades and maintaining consistent project structures across different CAS versions.

To use the Initializr, you typically need curl, http, and jq installed on your system.

CAS includes a throttling facility designed to mitigate password guessing and other authentication-related abuse scenarios. Throttling can be implemented using two primary strategies:

1. Capacity Throttling: Limits the total number of concurrent authentication attempts allowed by the system.
2. Failure Throttling: Limits the number of failed login attempts allowed (e.g., locking an account or delaying responses after multiple failures).

Refer to the specific configuration guides for Capacity Throttling and Failure Throttling to implement these protections.