Central Authentication System (CAS) Server

The CAS Server module turns your Drupal site into a Central Authentication Service (CAS) server. Your Drupal user accounts become the single source of truth for logins: other applications (Drupal sites, CMSs, LMSs, or anything with a CAS client) send users to your site to sign in, and your site tells them who the user is.

Users log in once and are signed in to every connected application for the rest of their session.

Features

• Implements the CAS 1.0, 2.0 and 3.0 protocols.
• XML and JSON validation responses.
• Proxy authentication (proxy-granting tickets and proxy tickets) for services that call back-end services on a user's behalf.
• Service definitions: only applications matching a registered service URL pattern can authenticate against your server.
• Per-service control over whether a service joins the single sign-on session or authenticates on its own.
• Per-service attribute release: choose which user fields are sent to each application, e.g. so it can create a matching local account.
• Role-based access: restrict which roles may log in to a given service, or to any service.
• Users can log in with their username, their email address, or either; the identifier returned to services can be the username, email address or user ID.
• Configurable lifetimes for login, service, proxy, proxy-granting and ticket-granting tickets.
• Customisable messages for invalid services, denied access, logout and already-logged-in users.
• Optional debug logging to help when connecting a new client.
• Events for developers to alter released attributes and tickets.

Requirements

• No additional contributed module dependencies.
• HTTPS with a valid certificate from a trusted CA. The CAS protocol requires it, and clients will refuse to validate against a server they can't trust.

Getting started

1. Install the module as usual.
2. Review the general settings at Configuration » People » CAS Server.
3. Add at least one service definition for each application that will authenticate against your site.
4. Point your applications' CAS clients at https://your-site.example/cas to authenticate.

CAS Server vs. CAS

This module provides the server side of the CAS protocol. If you want your Drupal site to log users in with an existing CAS server, use the CAS module instead. Do not enable both modules on the same site.

CAS Server replaces the server component that used to ship inside the CAS module.

Related modules

• CAS: the client. Use it on the Drupal sites that log in through your CAS Server.
• CAS Attributes: maps the attributes your server releases onto user fields and roles on client Drupal sites.