This module enables single sign-on (SSO) for your Drupal site using the CAS protocol. It redirects users to your institution's CAS server for authentication, using local Drupal user accounts. The module can optionally register new users automatically, force CAS authentication for specific pages, log users out of the CAS session, and map CAS attributes to Drupal user roles and fields.
This module provide single sign-on capability for your Drupal site by implementing the CAS protocol.
When using this module, local Drupal user accounts are still used, but the authentication process is not handled by Drupal's standard login form. Instead, users are redirected to your institution's CAS server to collect credentials. Your Drupal site just receives the username (and optionally some other attributes) from the CAS server after a successful authentication.
This module does not allow your site to act as a CAS server for other websites. There is a separate module that provides that support.
Here are some features of this module:
- Supports integration with CAS servers that implement protocol version 1.x, 2.x, 3.x.
- Optionally automatically register users that log in via CAS for the first time.
- Optionally force anonymous users to authenticate via CAS for a specific set of pages by path.
- Optionally configure Drupal's log out behavior to also end a user's CAS session.
- Optionally use your Drupal site as a CAS proxy, allowing you to authenticate to other services on behalf of the user.
- Optionally assign roles and field values to user accounts based on CAS attributes using the CAS Attributes module.
- For developers, there's many events you can subscribe to in a custom module to influence many behaviors of the login process.
Installation & Versions
Please refer to the README file for specific installation and configuration instructions.
3.0.x supports Drupal 10.3.x, 10.4.x, 11.0.x and 11.1.x versions and is recommended for use by everyone.
The 8.x-1.x, 2.0.x, 2.1.x, 2.2.x, 2.3.x branches no longer receive updates.
Security Note
It's critical that you ensure your site is not vulnerable to Host header injection attacks. There is documentation on how to protect against such attacks.
Dependencies
The light-weight External Auth module is required as it facilitates the mapping of CAS usernames to Drupal usernames.
CAS Attributes
Many CAS servers expose a set of attributes (e.g. email, name, etc) for each user during the login process. This module does not use these attributes by default, aside from specifying which attribute to pull a user's email from during auto-registration. To make full use of these attributes, use the companion CAS Attributes module, which allows mapping these attributes to user fields, assigning roles based on the value of some attribute, and exposing these attributes as Drupal tokens for other uses like Webforms.