Central Authentication Service (CAS) is a single sign-on (SSO) protocol that lets users authenticate once and access multiple applications without re-entering their credentials. RapidIdentity supports CAS protocol versions 1.0, 2.0, and 3.0. RapidIdentity can act as a CAS server, a CAS client, or both simultaneously, enabling several integration topologies.
As a credential requestor, RapidIdentity serves as the CAS server. It presents the login
form to the user, authenticates the user, and issues service tickets to downstream
applications. Applications redirect their unauthenticated users to the RapidIdentity
/login endpoint, where the user signs in once and receives access to
all participating services.
As a credential acceptor, RapidIdentity serves as a CAS client. It receives a service ticket from an upstream CAS server, validates the ticket, and accepts the authenticated session. In this role, RapidIdentity trusts an upstream CAS server to handle user authentication.
RapidIdentity can use both roles at the same time, supporting the following CAS integration patterns:
- CAS proxy (middle tier)
- RapidIdentity sits between an upstream CAS server and downstream applications. It accepts a service ticket from the upstream server, then issues proxy tickets to downstream services. This pattern uses the CAS 2.0 proxy ticket flow.
- CAS federation hub
- RapidIdentity acts as a CAS server for its own applications, but delegates authentication to an upstream identity provider (another CAS server, or a SAML or OIDC identity provider) when needed.
- CAS chaining
- Multiple CAS servers form a trust chain, with RapidIdentity as a node in the middle. Each server in the chain delegates to the next.