Apereo CAS

What Apereo CAS is

Apereo CAS is an open-source identity provider that gives web applications a common point for authentication and authorization. It sits between applications and authentication sources as middleware, and supports API, self-hosted, and web use. Its protocols include CAS, SAML v1 and v2, WS-Federation, OAuth2, OpenID Connect, and REST. Authentication can use sources such as LDAP, databases, X.509, SPNEGO, JAAS, JWT, RADIUS, and MongoDB; directory integrations include LDAP, Active Directory, and OpenLDAP.

CAS includes session management, single logout, and passwordless multifactor authentication. Its listed MFA providers include Duo Security, YubiKey, RSA/RADIUS, Google Authenticator, FIDO2 WebAuthn, Twilio, Inwebo, and CAS Simple. WebAuthn uses public-key cryptography and can rely on security keys or built-in platform authenticators. Authentication can also be delegated to services such as ADFS, Facebook, Twitter, SAML2 identity providers, and OpenID Connect providers. For operations, CAS monitors application and system behavior, statistics, and metrics in real time, with central audit and log management. Client support spans Java, .NET, PHP, Perl, and Apache. The project is licensed under Apache License 2.0 and costs nothing. Apereo staff direct support requests to CAS project communities and mailing lists.

Who it suits

CAS suits organizations that need a shared sign-in service for web applications and can operate a self-hosted identity provider. Its stated audience ranges from higher education to Fortune 500 companies and small, special-purpose installations.

Limits

The listed Apereo CAS plan is free under Apache License 2.0. Apereo staff do not provide technical project support and direct users to project communities and mailing lists.

Getting started

1. Visit the Apereo CAS website.
2. Choose API, self-hosted, or web use for your deployment.
3. Connect CAS to the authentication sources your applications use.
4. Configure supported protocols and multifactor providers for your sign-in needs.
5. Use the CAS project communities and mailing lists for support.

Verdict

Choose Apereo CAS if you need a free, open-source identity provider with broad protocol, authentication-source, and MFA support. It is especially suited to organizations able to manage self-hosted software and use project communities or mailing lists for support.