anz.cas 1.0

1 Introduction

anz.cas implement a new PAS plugin ‘Anz Central Auth Service’. It enabling you to turn your Plone site into a CAS server.

2 Overview

anz.cas gives you:

• A stand-alone central login page where the user enters their credentials.

• A mechanism for validating the user’s credentials against various backends (make use of PAS’s authentication plugins).

• A back-end validator where CAS-enabled client applications connect to check whether the current user is authenticated (if the user has already been authenticated with the CAS server, then they are permitted to proceed, otherwise they are redirected to the CAS server’s login page for authentication).

• Almost full compatibility with the open, multi-platform CAS protocol.

Why you would want/need this:

• CAS allows you to share authentication across domains.

• The user only sees the login page once – the first time they try to access any one of your CAS-protected services, and never again until they log out or their single-sign on session expires.

• Client applications never see the user’s actual credentials.

3 Credits

Thanks to those guys who developed the following products, without your works anz.cas will never happen.

• CAS

4 Comparison with JA-SIG’s CAS

5 Requirements

• Plone 3.0 or later

• ZODB3>=3.8.3 (test under 3.8.3 only)

• zope.proxy>=3.4.1 (test under 3.4.1 only)

• zope.bforest

• uuid

6 Installation

To install anz.cas into the global Python environment (or a workingenv), using a traditional Zope 2 instance, you can do this:

• When you’re reading this you have probably already run easy_install anz.cas. Find out how to install setuptools (and EasyInstall) here: http://peak.telecommunity.com/DevCenter/EasyInstall

• Create a file called anz.cas-configure.zcml in the /path/to/instance/etc/package-includes directory. The file should only contain this:

<include package="anz.cas" />

Alternatively, if you are using zc.buildout and the plone.recipe.zope2instance recipe to manage your project, you can do this:

• Add anz.cas to the list of eggs to install, e.g.:

[buildout]
...
eggs =
    ...
    anz.cas

• Tell the plone.recipe.zope2instance recipe to install a ZCML slug:

[instance]
recipe = plone.recipe.zope2instance
...
zcml =
    anz.cas

• Re-run buildout, e.g. with:

$ ./bin/buildout

You can skip the ZCML slug if you are going to explicitly include the package from another package’s configure.zcml file.

Then go into your Plone site install “anz.cas” product by quick_installer or portal_setup.

7 How to use anz.cas

anz.cas is designed to be easy to set up and customize.

8 Security Policy

anz.cas uses tickets to implement supported authentication protocols, so it follows that ticket behavior determines most aspects of security policy. In current implementation, anz.cas provides for the following:

• Ticket-granting tickets (TGT) that expire after more than 2 hours from its creation time.

• One-time-used service tickets (ST) that must be validated within 5 minutes.

More security policy will be added later.

9 ToDo

• Add automation tests ( I really don’t know how to automation test this kind of package :) )

• More compatibility with CAS protocol.

10 Changelog

1.0

• Initial release