CAS uses esup plug-in to authenticate single-point logon for DB users

The most frequently used method in SSO implementation is, of course, using relational databases to authenticate users. Using the esup plug-in can easily use the DB user authentication method for CAS, this document describes how to configure esup. Esup is mainly divided into three authentication modes: binding mode (that is, DB users can pass CAS authentication), and searching mode (that is, users in a table in dB can pass CAS authentication ), query mode (CAS authentication is enabled when the results obtained by using SQL query statements match user information ).

This method is esentially used by organizations of which some users, for technical or political reasons, are not registered in their LDAP directory but in a distinct database.

As well as for LDAP authentication, fault tolerance is insured by the redundancy of database servers, and three access modes are provided (Bind,SearchAndQuery).

Bind Mode

In this mode, users shoshould be declared in the database, I. e. Be database users; authentication is successfull when the information given by the user allows CAs to connect to the database.

One may use:

<authentication debug="off">
      <classname>
      org.esupportail.cas.server.handlers.database.SearchDatabaseHandler
    </classname>
    <config>
      <server>
        <jdbc_driver>com.mysql.jdbc.Driver</jdbc_driver>
        <jdbc_url>jdbc:mysql://127.0.0.1</jdbc_url>
      </server>
    </config>
  </authentication>

Search Mode

This mode uses a privileged connection to the database. The authentication informations (login and password) are stored in a table; authentication is successfull when information provided by the users are found in the database.

One may use:

<authentication debug="off">
      <classname>
org.esupportail.cas.server.handlers.database.SearchDatabaseHandler
    </classname>
    <config>
      <table>user</table>
      <login_column>login</login_column>
      <password_column>password</password_column>
      <bind_username>admin</bind_username>
      <bind_password>secret</bind_password>
      <server>
        <jdbc_driver>com.mysql.jdbc.Driver</jdbc_driver>
        <jdbc_url>jdbc:mysql://127.0.0.1</jdbc_url>
      </server>
    </config>
  </authentication>

When using this mode, the Administrator shoshould specify:

• The table of the database users are stored in;
• The columns storing the users 'id and password;
• The encryption used to store the password (optional );
• The credentials used to connect to the database (optional ).

Query Mode

This mode also uses a privileged connection to the database. The authentication informations are stored anywhere in the database, and authentication is successfull when information provided by the users matches the informations returned by the query.

One may use:

<authentication debug="off">
      <classname>
      org.esupportail.cas.server.handlers.database.QueryDatabaseHandler
    </classname>
    <config>
      <sql_query>
        SELECT md5_password FROM user WHERE login = '%u' AND NOT locked
      </sql_query>
      <encryption>md5</encryption>
      <bind_username>admin</bind_username>
      <bind_password>secret</bind_password>
      <server>
        <jdbc_driver>com.mysql.jdbc.Driver</jdbc_driver>
        <jdbc_url>jdbc:mysql://127.0.0.1</jdbc_url>
      </server>
    </config>
  </authentication>

When using this mode, the Administrator shoshould specify:

• TheSQL queryUsed to query the database. This query can contain the special "% u" token, which will be replace by the users 'netid at runtime;
• TheEncryptionUsed to store the password (plain, Des, MD5 and pammd5 are allowed, MD5 by default );
• TheCredentialsUsed to connect to the database (optional ).

Note: internally, a searchdatabasehandler is a querydatabasehandler using the following SQL query:

SELECT <password_column> FROM <table> WHERE <login_column> = '%u'

Database servers

The database servers are defined:

• The jdbc url of the database;
• The JDBC driver that shocould be used to access the database.

When specifying several servers, all the servers are considered as replicates: When authenticationfails on one database, Database Authentication fails because databases are intended to contain the same data; next (redundant) servers are tried only if the first one does not respond.

JDBC drivers

Cas gh developers usually place the jars implementing the JDBC drivers they use into the $ {tomcat. home}/webapps/CAS/WEB-INF/lib directory (classes are placed into $ {tomcat. home}/webapps/CAS/WEB-INF/classes), or, when using one of the esup-cas-server and esup-cas-quick-start packages, directly into the custom/CAS-server-patch/web/WEB-INF folder (so the files get deployed with ant ).

No JDBC driver is provided with cas gh, but the following links may help to find the JDBC driver corresponding to your database:

• Hypersonic SQL: http://hsql.sourceforge.net
• MySQL: http://dev.mysql.com/downloads/connector/j/3.0.html
• ORACLE: http://otn.oracle.com/software/tech/java/sqlj_jdbc/index.html
• PostgreSQL: http://jdbc.postgresql.org/download.html