3 ms·

Has anyone worked with or have a strong opinion regarding CAS? http://www.yale.edu/tp/auth/cas10.html http://www.yale.edu/tp/auth/cas10.html It's very similar

Has anyone worked with or have a strong opinion regarding CAS? http://www.yale.edu/tp/auth/cas10.html http://www.yale.edu/tp/auth/cas10.html It's very similar to OAuth, except way simpler to understand, and very easy to implement (I'm working on a standalone go server that will perform authentication, but have been dragging my feet a bit so it's not done yet -- basically the only reason it's not shipped is that it's failing tests)

hardwaresofton 11y ago
Oh for those interested, here's the standalone server I've been working on (it's super rough): https://github.com/t3hmrman/casgo https://github.com/t3hmrman/casgo While there are other versions of the CAS specification (v2, v3, v4), my implementation sticks pretty close to v1, since it has what you really need (I diverge a little because I use JSON).
jldugger 11y ago
CAS is not federated. If your CAS authenticated wiki detects you're not logged in, it redirects you to what it knows as the CAS url, not YOUR CAS url. This makes it wonderful for universities and large institutions that deploy lots of small applications and buy third party hosted services, as you can keep the passwords local while proving identity and providing relying parties limited data they may need for authorizations. But if you don't have an account my CAS setup recognize, you'll need to make one first. And if you have one with another institution, we won't recognize it.
- hardwaresofton 11y ago
  Yes, CAS is primarily for that usecase, but could you explain what stops Facebook (or some other current oauth provider) from running a CAS server and enabling me to register a callback URL and using it to authenticate a user visiting my site? Maybe I'm misunderstanding something fundamental
  - jldugger 11y ago
    Well, I mean, a lot of the complaints about OAuth2 revolve around how the system was designed for high scalability over security; OAuth tokens never expire. Beyond that, I'd have to think a bit. I haven't studied OAuth2 in sufficient detail really.
scintill76 11y ago
One thing I didn't like as a user, is that to a typical user on my university's installation, it was possible for any third party to invoke the auth flow in a hidden iframe, meaning they could silently log user IDs if the user was signed in to CAS, and potentially have a sort of super-cookie to track people with or discover real-life identities. The user's recourse is to tick a checkbox on the login page to warn on each subsequent authentication. I made a userscript to always select that option and also add a shortcut key to quickly approve from the confirmation page (since it came up quite often when navigating through the myriad products that run the university.) I did think it was cool that they allowed third parties to use the system, but wish there were some easier way to prevent abuse. I don't have a lot of knowledge of other auth systems, but the CAS architecture did seem pretty simple -- maybe too simple for some usecases. I know my university sent extra user data (besides just the user ID) to HTTPS sites on *.university.edu, so potentially that could be used to deliver user info or tokens to retrieve more later.

hardwaresofton 11y ago

Oh for those interested, here's the standalone server I've been working on (it's super rough): https://github.com/t3hmrman/casgo https://github.com/t3hmrman/casgo While there are other versions of the CAS specification (v2, v3, v4), my implementation sticks pretty close to v1, since it has what you really need (I diverge a little because I use JSON).

jldugger 11y ago

CAS is not federated. If your CAS authenticated wiki detects you're not logged in, it redirects you to what it knows as the CAS url, not YOUR CAS url. This makes it wonderful for universities and large institutions that deploy lots of small applications and buy third party hosted services, as you can keep the passwords local while proving identity and providing relying parties limited data they may need for authorizations. But if you don't have an account my CAS setup recognize, you'll need to make one first. And if you have one with another institution, we won't recognize it.

hardwaresofton 11y ago
Yes, CAS is primarily for that usecase, but could you explain what stops Facebook (or some other current oauth provider) from running a CAS server and enabling me to register a callback URL and using it to authenticate a user visiting my site? Maybe I'm misunderstanding something fundamental
- jldugger 11y ago
  Well, I mean, a lot of the complaints about OAuth2 revolve around how the system was designed for high scalability over security; OAuth tokens never expire. Beyond that, I'd have to think a bit. I haven't studied OAuth2 in sufficient detail really.

scintill76 11y ago

One thing I didn't like as a user, is that to a typical user on my university's installation, it was possible for any third party to invoke the auth flow in a hidden iframe, meaning they could silently log user IDs if the user was signed in to CAS, and potentially have a sort of super-cookie to track people with or discover real-life identities. The user's recourse is to tick a checkbox on the login page to warn on each subsequent authentication. I made a userscript to always select that option and also add a shortcut key to quickly approve from the confirmation page (since it came up quite often when navigating through the myriad products that run the university.) I did think it was cool that they allowed third parties to use the system, but wish there were some easier way to prevent abuse. I don't have a lot of knowledge of other auth systems, but the CAS architecture did seem pretty simple -- maybe too simple for some usecases. I know my university sent extra user data (besides just the user ID) to HTTPS sites on *.university.edu, so potentially that could be used to deliver user info or tokens to retrieve more later.