2 ms·
CAS is not federated. If your CAS authenticated wiki detects you're not logged in, it redirects you to what it knows as the CAS url, not YOUR CAS url. This mak
by jldugger 11y ago
CAS is not federated. If your CAS authenticated wiki detects you're not logged in, it redirects you to what it knows as the CAS url, not YOUR CAS url.
This makes it wonderful for universities and large institutions that deploy lots of small applications and buy third party hosted services, as you can keep the passwords local while proving identity and providing relying parties limited data they may need for authorizations.
But if you don't have an account my CAS setup recognize, you'll need to make one first. And if you have one with another institution, we won't recognize it.
- hardwaresofton 11y agoYes, CAS is primarily for that usecase, but could you explain what stops Facebook (or some other current oauth provider) from running a CAS server and enabling me to register a callback URL and using it to authenticate a user visiting my site? Maybe I'm misunderstanding something fundamental
- jldugger 11y agoWell, I mean, a lot of the complaints about OAuth2 revolve around how the system was designed for high scalability over security; OAuth tokens never expire. Beyond that, I'd have to think a bit. I haven't studied OAuth2 in sufficient detail really.