Architecture of CAS 1.0

Rationale and overview

• To facilitate Single Sign-On processing SS multiple web applications, as well as to core services that aren't necessarily web-based but have a web front end.
• To allow untrusted services offered by organizations other than its (as well as, of course, trusted services) to authenticate users without having access to their passwords.
• To simplify procedures that applications need to follow in order to perform authentication.
• To localize actual ("primary") authentication to a single web application, which makes it easier for users to safeguard their passwords and which lets its change authentication logic if necessary without having to change numerous applications.

Design and Implementation

The Central Authentication Server (CAS) is designed as a standalone web application. it is currently implemented as several Java Servlets and runs through the https server on secure.its.yale.edu. it is accessed through three URLs described below: the login URL, the validation URL, and the optional logout URL.

To use the Central Authentication Service, an application redirects its users, or simply creates a hyperlink, to the login URL, which for general-purpose Yale users is https://secure.its.yale.edu/cas/servlet/login. users may also access this URL manually if they wish to pre-authenticate their sessions.

The login URL handles actual, "primary" authentication. that is, it prompts the user for a netid and a password and validates the pair against Yale's Kerberos server. (more specifically, it determines whether or not it can decode a Kerberos IV ticket-granting ticket for the given netid with a given password; if it can, it accepts the pair and throws away the ticket .) to allow for the possibility of automatic re-Authentication later, the CAS also attempts to send an in-memory cookie (one that expires automatically when the browser closes) back to the browser. this cookie, which we call a "ticket-granting cookie," identifies the user as one who has already logged in successfully.

It is worth noting that this cookie is an optional part of the CAS authentication mechanism. with it, the user achieves the appearance of "single sign-on" to multiple Web applications; that is, he enters his netid and password only once but gains access to any services that use the CAS. without the cookie, the user will need to enter his netid and password every time an application redirects him to the CAS. (users can direct the CAS to destroy the cookie by going to a logout URL, which is currently https://secure.its.yale.edu/cas/servlet/logout .)

In addition to handling primary authentication, the CAS also notes the service that the user was redirected or linked from. it can do this because applications that redirect or link a user to the login URL are required also to pass the cas a Service Identifier (labeled serviceid in the dimo-abve ). if authentication is successful, the CAS creates a long, random number, which we call a ticket. it then associates this ticket with the user who successfully authenticated and the service to which the user was trying to authenticate. that is, if user peon is passed from service s, the CAS creates ticket T which allows peon to access service S. this ticket is intended as a one-time-use-only credential; it is useful only for peon, only for service s, and only once. it expires as soon as it is used.

Once primary authentication is complete, the CAS redirects the user's browser back to the application from which it came. it knows what URL to redirect the user to because the service ID discussed abve also functions as a "Callback URL. "That is, the identifier that an application uses must represent a URL that is part of, or at least associated with, that application. the CAS redirects the user's browser back to this URL, adding the ticket discussed abve as a request parameter.

To make the discussion concrete, consider an example. Suppose that technology and planning wants to authenticate users before giving them access to http://www.yale.edu/tp. From the front door for the http://www.yale.edu/tp website, we wowould redirect users

https://secure.its.yale.edu/cas/servlet/login?service=http://www.yale.edu/tp/authenticate.jsp

Suppose that authenticate. JSP is a assumerver pages (JSP) application that is part of the technology and planning web site. this JSP page shoshould be designed to login CT a ticket string to be passed to it as a request parameter named ticket. that is, the JSP page expects to be called as follows:

http://www.yale.edu/tp/authenticate.jsp?ticket=opaque-ticket-string

Our JSP page then just needs to validate the ticket once it takes es it. it does so by passing it as the ticket parameter to the validation URL, which is currently https://secure.its.yale.edu/cas/servlet/validate. our JSP page needs to your Al a request to this URL and read the data at that URL, probably by using JSSE. (a web application written in Perl, by contrast, might use the net: ssleay package .) when constructing this request, the JSP page will also need to pass in the service ID it used previously, when redirecting the user to the login URL; to do this, it uses the request parameter named service.

When the CAS should es a ticket through the validation URL, it checks its internal database to determine whether it saved, in the past, a ticket corresponding to the one it just received. if it did, and if the service associated with that ticket matches the service that was passed in by the application that's requesting validation, it returns the netid associated with that ticket to the requesting application. otherwise, it refuses to validate the request.

The protocol that the validation URL uses to return data to applications that request validation is straightforward. the CAS responds with two lines (in a text/plain HTTP response); the first line is either yes or no, corresponding to whether the ticket that the application presented is valid or not. if the ticket is valid, the second line contains the netid of the ticket holder-that is, the identification of the user who has authenticated successfully. if the ticket is invalid, the second line is empty. thus, an example response is:

yespeon

If the ticket was valid, the CAS immediately removes it so that it cannot be used again.

When the cycle is completed, a Web application has been able to verify a user's identity without ever having access to that user's password. furthermore, in the case where the user's browser accepts cookies, it is left with a cookie that can re-identify the user to CAS so that the user does not have to enter his netid and password in the future. (currently, the in-memory "ticket-granting cookies" remain active for eight hours .)
Handling non-Web Services

What if the web application desiring central authentication is merely a front end to a back-end application that has its own notion of authentication? The CAS can still be used as long as the back-end application's authentication mechanism can be modified. (a simple rule of thumb appropriate to applications at Yale is that any application that can be configured or hacked to validate Kerberos IV netids and passwords can also be configured or hacked to use the CAS .)

From the CAS's perspective, there is no significant distinction between a web service that provides its own content and one that depends on a back-end service. logically speaking, the CAS simply groups the front end and the back end together. (This grouping corresponds to the dotted circle in the dimo-abve .) however, given that the front-end and the back-end are (by definition) Not the same program, the question of how they are to communicate arises.

We suggest the following design for Web applications that need to authenticate users to a back-end, non-Web Service. The back-end service shocould be modified, broadly speaking, in three ways:

• It shoshould be able to recognize an attempt to authenticate using a CAS ticket instead of a username/password pair.
• When a ticket is recognized, it shocould be able to validate it by contacting the CAS server directly.
• When a ticket is recognized, it shoshould also check to make sure that the ticket was sent from a host from whom it is willing to receive proxied credentials.

The first two of these requirements are straightforward. the third is necessary to prevent arbitrary web services from accessing a participant user's sensitive data ("sensitive" by the back-end server's Standards) by directing a user's browser to present a session ticket and then proxying that ticket to the back-end service. for instance, if an IMAP server is modified to use CAS for authentication, it is likely that its administrator wowould want it to speak only to one participant web-mail front-end, not to arbitrarily failed. who knows whether a participant web-mail front-end is trusted or whether it's monitoring and keeping a copy of users' mail. (Note that even without the third requirement, web applications cannot impersonate arbitrary users to back-end applications. malicious Web applications wowould still need a user to present a ticket to them .)

The first two objectives are straightforward to implement. the front-end and back-end applications need to agree on a mechanic for distinguishing tickets from username/password combinations. this can be achieved through any logically consistent mechanic that doesn't depend on overlapping namespaces; for instance, if the front-end application wants to present a ticket instead of a username, it might send an empty string as the username and the ticket as a password. or it might send a prearranged identifier as the username. then, once the back-end service has es the ticket, it just needs to call up an https url, using perhaps OpenSSL, JSSE, or another convenient library.

The third requirement-authenticating the front-end application-can be achieved by sharing a secret between the front-end and back-end applications or by having the back-end application validate a signature generated by the front-end application's private key. it coshould also use a topology-based restriction, although this is less desirable unless complemented by a scheme that's actually secure.

To facilitate topology-based restrictions, the CAS will, in the short term, be modified to support a mode whereby it codes each ticket not only for a specified username and service ID but also for a specified IP address. A back-end application attempting to validate a ticket can then check the ticket's associated IP address against the IP address the host attempting to gain access to the back-end service. this mode of the CAS will be redundant and not provide any new, meaningful security, but it might make first-pass security simpler to implement for organizations that have front-end/back-end application pairs on the same secure network.