Central Authentication Service (CAS)
CAS is an Enterprise Java solution for web application authentication that also provides the benefit of SSO. Technically, SSO can be achieved because the authentication can be removed from the web application and handled centrally. And, when this authentication is handled by a single service, access to many services can be granted once and remembered for the life of the web session or even longer. The SSO feature does not have to be employed and yet CAS authentication still provides a reliable authentication mechanism.
CAS server
The CAS server is a Java servlet built on the Spring Framework. Its primary responsibility is to authenticate users and grant access to CAS-enabled services, commonly called CAS clients or services, by issuing and validating tickets. An SSO session is created when the CAS server issues a ticket-granting ticket (TGT) to the user upon successful login. A service-ticket (ST) is issued to a service at the user's request via browser redirect using the TGT as a token. The ST is subsequently validated at the CAS server via back-channel communication. Transact also supports proxy-granting-ticket (PGT), in which the server issues a PGT to Transact. Transact uses this PGT to create proxy tickets for accessing other web applications under the same authentication umbrella.
CAS clients
The term CAS client has two distinct meanings in its common use. A CAS client is any CAS-enabled application that can communicate with the server via a supported protocol. A CAS client is also a software package that can be integrated with various software platforms and applications to communicate with the CAS server via some authentication protocol (such as CAS, SAML, and OAuth). In this case, Transact is a CAS client that communicates with the CAS server for the purpose of authentication and SSO.
CAS with proxy support
If proxy support is required, the CAS client requests a proxy-granting-ticket (PGT) rather than a normal service-ticket (ST). Using this proxy ticket, the CAS client can securely communicate with other CAS clients under the same CAS SSO umbrella. This rapidly increases the performance of the CAS client when communicating with other CAS clients under this umbrella because the CAS client with PGT no longer needs to request an ST for each request to other CAS clients. Configuring the CAS client with proxy support should be handled carefully as improper configuration may lead to a security breach. Proper configuration steps and suggestions are provided below.
CAS without proxy support
CAS without proxy support should be used when there is only a single application under the SSO umbrella or when the system does not require communication between CAS clients under the same umbrella. When CAS is used without proxy support, the CAS client works on a service-ticket (ST) granted by the CAS server. This configuration is preferable if the situation does not require proxy support as it is less vulnerable to a security breach.