Magnolia 4.5 reached end of life on June 30, 2016. This branch is no longer supported, see End-of-life policy.
CAS Connector 1.1
This document applies to CAS Connector 1.1 which needs Magnolia 4.5 and LDAP Connector 1.5. Note that LDAP Connector 1.5 authenticates against one LDAP or Active Directory server at a time. If you have multiple servers and want users to be authenticated against all of them, use the earlierand instead.
Central Authentication Service (CAS) provides a single sign-on protocol for the Web. CAS enables applications to authenticate a user without needing to access the user's security credentials (login and password). The name CAS also refers to a software package that implements this protocol.
To use the Magnolia CAS module, you will need to download the appropriate software. The CAS authentication system was originally created by Yale University to provide a secure means for an application to authenticate a user, and as such, still forms part of the JASIG project.
CAS Connector is an Enterprise Edition module available in the
add-ons folder of the Magnolia Enterprise Edition bundle. You can also download the module from Magnolia Store or Nexus repository. The Magnolia CAS module runs in conjunction with JASIG CAS software. You can download the JASIG CAS server software from the Central Authentication Service project website .
To install the CAS module, see the general module installation instructions.
See the general module uninstalling instructions and advice.
The Central Authentication Service is a single sign-on (SSO) Web protocol that permits a user to log in once to a system and then automatically gain access to all related systems to which they have been granted permission as per their credentials. This avoids the need to log into each system individually.
The Magnolia CAS module handles authentication only. When a user logs into CAS, the system authenticates their identity to participating services because the user has been authenticated to CAS. The individual services determine if the user has appropriate access rights.
In a real world situation, a company can use a customized Jasig CAS application as a login interface. The interface shows the company logo and provides a login and password area. When a user logs into the interface they are taken to a page containing links to a selection of applications, including the author instance of Magnolia. (Note, there is no cross-integration of applications.) The user does not need to sign in a second time in order to use Magnolia CM, but clicks on the application link and is granted access.
Note that at present the CAS module 1.1 requires and only works in conjunction with the LDAP Connector 1.5+. The LDAP Connector is a standard JAAS login module and connects to any LDAP V3 supported directory service. In addition, before using the CAS functionality with Magnolia, it is first necessary to have a Jasig CAS environment set up.
ad.propertiesfile is set to
JAAS is a standard authentication and authorization API provided by Java 1.4 and higher. An external file is used to configure JAAS. Using JAAS with CAS allows modification of the authentication process without having to rebuild and redeploy CAS.
jaas.config file, split
info.magnolia.jaas.sp.ldap.ADAuthenticationModule into different JAAS chains:
In Magnolia configuration, set the
jaasChain property to
It is not possible to use the LDAPAuthenticationModule in jaas.config because the module requires a user password which CAS does not provide.
casLoginURLto point to the login form of your CAS server.
casLogoutURLto point to the logout page of your CAS server.
casServiceURLto match your current Magnolia instance.
casValidateURLto point to your CAS server.
Note that provided you have not changed this parameter in the CAS server implementation, it should not be necessary to adjust
casnode as the first node in the tree. Typically, the first node in the list in a default configuration is the
If you have problems using CAS with a self-signed certificate, try adding the following line to the relevant magnolia.properties:
magnolia.cas.sslDebug=true. IMPORTANT - Do not use this setting in a production environment.