SAML or CAS on Windows or Linux

Message from leifj@sunet.se

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/13/2012 03:02 PM, pmorley@mcdaniel.edu wrote: > > Good Morning, > > We are looking for a solution for Single Sign-On that can be > implemented fairly quickly that supports either CAS or SAML. > > We have an outside vendor who is trying to integrate with us. > > Has anyone worked with SSO Easy, a 3rd party company that provides > a Windows based SSO provider, but is specific to the integration > from the perspective of licensing. No, but why not just use ADFS2? You have to grow a certain level of affinity with powershell in order to get some stuff done but apart from that its a decent SAML2-implementation for Windows compatible (using a certain about of elbow-grease) with the profiles in use by InCommon and other large-scale deployments of SAML2 today. Cheers Leif -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk8QPHYACgkQ8Jx8FtbMZneIrwCgpfMhlpmy2/v3t5YZwuBqDzh3 luAAnj+DlwxBn4h/XkIHAgPkApyLTWrY =7LuW -----END PGP SIGNATURE-----

Message from marvin.addison@gmail.com

> We are looking for a solution for Single Sign-On that can be implemented > fairly quickly that supports either CAS or SAML. If you only have a single use case to drive your choice of SSO product, it's going to be a tough decision. Both Jasig CAS and Shibboleth are sound SSO products and share a common ground, but each has strengths and capabilities outside their shared feature set. If you have or anticipate the need to do a fair amount of SSO outside institutional boundaries, then Shib is probably the best bang for your buck. If, on the other hand, you have the need for SSO exclusively within your insitutional boundaries or with few exceptions, then CAS may be a better fit. The good news is that CAS and Shib can live quite happily together. We use CAS for SSO within our institution, and federate with InCommon and other service providers (e.g. Google Apps) via Shib, yet CAS is the authentication provider in both cases. While the word "quickly" doesn't come to mind for enterprise deployments generally, I would imagine you could set up either product fairly quickly for QA and testing with capable staff. It's the large scale integration and tuning that take the time, but I would imagine that would be an aspect of any solution. M

If I were limited to a choice between Shibboleth and CAS, I would probably repeat what IU did and deploy CAS first. Then, when/if you have a need to deploy Shibboleth, you can use CAS as the authenticator for Shibboleth. CAS has been extremely popular at IU in large part because of how easy it is to integrate into an application. We use it almost exclusively for internal application, and use it as the authenticator for Shibboleth for external scenarios. Jacob