Multiple AuthenticationHandlers

[Dallas]

In the case where I multiple AuthenticationHandlers and multiple service apps, I need to specify which auth handler is to be used for a given service app. Is there a way to configure CAS server (3.2.1) to do this type of filtering. Or has someone implemented an extension to the AuthenticationManager to support this?  

I saw some old threads pertaining to this question but didn't get the feel it has been answered.

[Scott Battaglia-2]

CAS is designed for the notion that you've rationalized your user population such that they have a unique identifier across your applications.  Its not designed for the situation where one user has a different username per application.  You could probably force it to do it if it was only usernames, but you definitely couldn't if they all had different passwords that need to be validated.

Cheers,
Scott

On Thu, Nov 5, 2009 at 10:01 AM, Dallas <[hidden email]> wrote:

In the case where I multiple AuthenticationHandlers and multiple service
apps, I need to specify which auth handler is to be used for a given service
app. Is there a way to configure CAS server (3.2.1) to do this type of
filtering. Or has someone implemented an extension to the
AuthenticationManager to support this?

I saw some old threads pertaining to this question but didn't get the feel
it has been answered.
--
View this message in context: http://n4.nabble.com/Multiple-AuthenticationHandlers-tp510132p510132.html
Sent from the CAS Users mailing list archive at Nabble.com.

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Dallas]

Well, it is not really a situation where a user has a different credential per app, it is more along the lines of we have some apps that are public facing that would be authenticating against one set of data  stores and some apps that are only for internal use that would be authenticating against a different set of data stores. We had been going down the road of having one CAS instance handle the authentication chores for both by setting up the appropriate auth handlers for each of the datastores but needed to be able to indicate, for example, that if the user is coming to us from a public facing site that the auth handlers that are pointing at data stores meant for internal users are never used. We were looking at trying to extend the AuthenticationManager do do what we wanted but to solve this we just decided to spin up two different instances of CAS.  One will be used for public facing sites and one will be used for internal facing sites. Seemed like the simplest approach that solves the problem.

Scott Battaglia-2 wrote:

CAS is designed for the notion that you've rationalized your user population
such that they have a unique identifier across your applications.  Its not
designed for the situation where one user has a different username per
application.  You could probably force it to do it if it was only usernames,
but you definitely couldn't if they all had different passwords that need to
be validated.

Cheers,
Scott


On Thu, Nov 5, 2009 at 10:01 AM, Dallas <[e-mail]> wrote:

>
>
> In the case where I multiple AuthenticationHandlers and multiple service
> apps, I need to specify which auth handler is to be used for a given
> service
> app. Is there a way to configure CAS server (3.2.1) to do this type of
> filtering. Or has someone implemented an extension to the
> AuthenticationManager to support this?
>
> I saw some old threads pertaining to this question but didn't get the feel
> it has been answered.
> --
> View this message in context:
> http://n4.nabble.com/Multiple-AuthenticationHandlers-tp510132p510132.html
> Sent from the CAS Users mailing list archive at Nabble.com.
>
> --
> You are currently subscribed to [e-mail] as:
> [e-mail]
> To unsubscribe, change settings or access archives, see
> http://www.ja-sig.org/wiki/display/JSG/cas-user
>

--
You are currently subscribed to [e-mail] as: [e-mail]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Scott Battaglia-2]

You use of two CAS servers is the simplest and probably best solution.  If its two different populations (with different usernames) they should not be using the same CAS instance.  Otherwise you'll be in a weird situation where if someone logs in with their public ID and they go to an internal app it will reject them.

Cheers,
Scott

On Fri, Nov 6, 2009 at 9:31 AM, Dallas <[hidden email]> wrote:

Well, it is not really a situation where a user has a different credential
per app, it is more along the lines of we have some apps that are public
facing that would be authenticating against one set of data  stores and some
apps that are only for internal use that would be authenticating against a
different set of data stores. We had been going down the road of having one
CAS instance handle the authentication chores for both by setting up the
appropriate auth handlers for each of the datastores but needed to be able
to indicate, for example, that if the user is coming to us from a public
facing site that the auth handlers that are pointing at data stores meant
for internal users are never used. We were looking at trying to extend the
AuthenticationManager do do what we wanted but to solve this we just decided
to spin up two different instances of CAS.  One will be used for public
facing sites and one will be used for internal facing sites. Seemed like the
simplest approach that solves the problem.

Scott Battaglia-2 wrote:
>
> CAS is designed for the notion that you've rationalized your user
> population
> such that they have a unique identifier across your applications.  Its not
> designed for the situation where one user has a different username per
> application.  You could probably force it to do it if it was only
> usernames,
> but you definitely couldn't if they all had different passwords that need
> to
> be validated.
>
> Cheers,
> Scott
>
>
> On Thu, Nov 5, 2009 at 10:01 AM, Dallas <[hidden email]> wrote:
>
>>
>>
>> In the case where I multiple AuthenticationHandlers and multiple service
>> apps, I need to specify which auth handler is to be used for a given
>> service
>> app. Is there a way to configure CAS server (3.2.1) to do this type of
>> filtering. Or has someone implemented an extension to the
>> AuthenticationManager to support this?
>>
>> I saw some old threads pertaining to this question but didn't get the
>> feel
>> it has been answered.
>> --
>> View this message in context:
>> http://n4.nabble.com/Multiple-AuthenticationHandlers-tp510132p510132.html
>> Sent from the CAS Users mailing list archive at Nabble.com.
>>
>> --
>> You are currently subscribed to [hidden email] as:
>> [hidden email]
>> To unsubscribe, change settings or access archives, see
>> http://www.ja-sig.org/wiki/display/JSG/cas-user
>>
>

> --

> You are currently subscribed to [hidden email] as:

> [hidden email]

> To unsubscribe, change settings or access archives, see
> http://www.ja-sig.org/wiki/display/JSG/cas-user
>

--
View this message in context: http://n4.nabble.com/Multiple-AuthenticationHandlers-tp510132p547780.html

Sent from the CAS Users mailing list archive at Nabble.com.

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user