CAS Connector 1.1
This document applies to CAS Connector 1.1 which needs Magnolia 4.5 or 5 and LDAP Connector 1.6. Note that LDAP Connector 1.6 authenticates against one LDAP or Active Directory server at a time. If you have multiple servers and want users to be authenticated against all of them, use the earlierand instead.
Central Authentication Service (CAS) provides a single sign-on protocol for the Web. CAS enables applications to authenticate a user without needing to access the user's security credentials (login and password). The name CAS also refers to a software package that implements this protocol.
To use the Magnolia CAS module, you will need to download the appropriate software. The CAS authentication system was originally created by Yale University to provide a secure means for an application to authenticate a user, and as such, still forms part of the JASIG project.
The CAS Connector module is bundled with Magnolia and typically already installed. You can download it from our Nexus repository The Magnolia CAS module runs in conjunction with JASIG CAS software. You can download the JASIG CAS server software from the Central Authentication Service project website .
CAS Connector is an Enterprise Edition module. It is typically already installed. Launch the Configuration app and go to
/modules/cas-connector to check.
How CAS works
The Central Authentication Service is a single sign-on (SSO) Web protocol that permits a user to log in once to a system and then automatically gain access to all related systems to which they have been granted permission as per their credentials. This avoids the need to log into each system individually.
CAS and Magnolia
The Magnolia CAS module handles authentication only. When a user logs into CAS, the system authenticates their identity to participating services because the user has been authenticated to CAS. The individual services determine if the user has appropriate access rights.
CAS process summary
- User attempts to access Magnolia. The user is redirected to the CAS login URL over a secure connection. The name of the requested service is passed as a a parameter.
- The user enters ID and password details on login page.
- CAS then authenticates the user and redirects the user back to Magnolia, appending a ticket parameter to the URL.
- The application validates the ticket and represents a valid user by calling the CAS serviceValidate URL. It does this by opening an HTTPS connection and passing the ticket and service name as parameters.
- CAS checks that ticket is valid for the requested service. After successful validation, CAS returns the username to the application.
In a real world situation, a company can use a customized Jasig CAS application as a login interface. The interface shows the company logo and provides a login and password area. When a user logs into the interface they are taken to a page containing links to a selection of applications, including the author instance of Magnolia. (Note, there is no cross-connection of applications.) The user does not need to sign in a second time in order to use Magnolia CM, but clicks on the application link and is granted access.
Note that at present the CAS module 1.1 requires and only works in conjunction with the LDAP Connector Module 1.6. The LDAP Connector is a standard JAAS login module and connects to any LDAP V3 supported directory service. In addition, before using the CAS functionality with Magnolia, it is first necessary to have a Jasig CAS environment set up.
- Ensure that the LDAP connections are set up correctly. Note that the CAS module 1.1 authenticates only against one LDAP or Active Directory server at a time.
- Check that the
ad.propertiesfile is set to
JAAS is a standard authentication and authorization API provided by Java 1.4 and higher. An external file is used to configure JAAS. Using JAAS with CAS allows modification of the authentication process without having to rebuild and redeploy CAS.
jaas.config file, split
info.magnolia.jaas.sp.ldap.ADAuthenticationModule into different JAAS chains:
In Magnolia configuration, set the
jaasChain property to
It is not possible to use the LDAPAuthenticationModule in jaas.config because the module requires a user password which CAS does not provide.
Configure the CAS module
Go to Configuration >
casLoginURLto point to the login form of your CAS server.
casLogoutURLto point to the logout page of your CAS server.
casServiceURLto match your current Magnolia instance.
casValidateURLto point to your CAS server.
Provided you have not changed this parameter in the CAS server implementation, it should not be necessary to adjust
Magnolia 5.3.14 / CAS 1.3 The
casServiceURL property is appended to the
casLougoutURL property to provide a link back to the application after logging out. In the example above the logout URL will be
Setting the CAS server
Go to Configuration >
casnode as the first node in the tree. Typically, the first node in the list in a default configuration is the
- The next time a user log outs and logs in again, they will be redirected to the CAS server login page.
- To check that CAS has been configured correctly, log into Magnolia:
If you have problems using CAS with a self-signed certificate, try adding the following line to the relevant magnolia.properties:
magnolia.cas.sslDebug=true. IMPORTANT - Do not use this setting in a production environment.