SSO with CAS or OAuth?

by

OpenID is not a ‘successor’ or ‘substitute’ for CAS, they’re different, in intent and in implementation.

CAS centralizes authentication. Use it if you want all your (probably internal) applications to ask users to login to a single server (all applications are configured to point to a single CAS server).

OpenID decentralizes authentication. Use it if you want your application to accept users login to whatever authentication service they want (the user provides the OpenID server address – in fact, the ‘username’ is the server’s URL).

None of the above handle authorization (without extensions and/or customization).

OAuth handles authorization, but it is not a substitute for the traditional ‘USER_ROLES table’ (user access). It handles authorization for third-parties.

For example, you want your application to integrate with Twitter: a user could allow it to tweet automatically when they update their data or post new content. You want to access some third-party service or resource on behalf of a user, without getting his password (which is obviously unsecure for the user). The application asks Twitter for access, the user authorizes it (through Twitter), and then the app may have access.

So, OAuth is not about Single Sign-On (nor a substitute for the CAS protocol). It is not about you controlling what the user can access. It is about letting the user to control how their resources may be accessed by third-parties. Two very different use-cases.

To the context you described, CAS is probably the right choice.

[updated]

That said, you can implement SSO with OAuth, if you consider the identity of the user as a secured resource. This is what ‘Sign up with GitHub’ and the likes do, basically. Probably not the original intent of the protocol, but it can be done. If you control the OAuth server, and restrict the apps to only authenticate with it, that’s SSO.

No standard way to force logout, though (CAS has this feature).

More Related Contents:

  1. Why Does OAuth v2 Have Both Access and Refresh Tokens?
  2. Cross Domain Login – How to log a user in automatically when transferred from one domain to another
  3. client secret in OAuth 2.0
  4. Fundamental difference between Hashing and Encryption algorithms
  5. What is the best way to implement “remember me” for a website? [closed]
  6. How to redirect all HTTP requests to HTTPS
  7. Will web browsers cache content over https
  8. Best way to handle security and avoid XSS with user entered URLs
  9. SSL and man-in-the-middle misunderstanding
  10. How do you protect your software from illegal distribution? [closed]
  11. How can I throttle user login attempts in PHP
  12. Why is using a Non-Random IV with CBC Mode a vulnerability?
  13. What should every programmer know about security? [closed]
  14. Is it safe to put a jwt into the url as a query parameter of a GET request?
  15. OAuth secrets in mobile apps
  16. Stopping users voting multiple times on a website
  17. How do I store and retrieve credentials from the Windows Vault credential manager?
  18. MVC 6 Bind Attribute disappears?
  19. Username and password in https url
  20. How will a server become vulnerable with chmod 777?
  21. What is the difference between a cer, pvk, and pfx file?
  22. IIS7, web.config to allow only static file handler in directory /uploads of website
  23. How to do stateless (session-less) & cookie-less authentication?
  24. WS on HTTP vs WSS on HTTPS
  25. Should I impose a maximum length on passwords?
  26. Is there a way to force apache to return 404 instead of 403?
  27. RSA signature size?
  28. Google Authenticator available as a public service?
  29. Should be used for JSF 2.2 CSRF protection?
  30. Setting cookie in iframe – different Domain

Leave a Comment