<abbrtitle="LemonLDAP::NG">LL::NG</abbr> can act as an <abbrtitle="Central Authentication Service">CAS</abbr> server, that can allow one to federate <abbrtitle="LemonLDAP::NG">LL::NG</abbr> with:
<liclass="level1"><divclass="li"> Another <abbrtitle="LemonLDAP::NG">LL::NG</abbr> system configured with <ahref="authcas.html"class="wikilink1"title="documentation:2.0:authcas">CAS authentication</a></div>
</li>
<liclass="level1"><divclass="li"> Any <abbrtitle="Central Authentication Service">CAS</abbr> consumer</div>
</li>
</ul>
<p>
<abbrtitle="LemonLDAP::NG">LL::NG</abbr> is compatible with the <ahref="https://jasig.github.io/cas/development/protocol/CAS-Protocol-Specification.html"class="urlextern"title="https://jasig.github.io/cas/development/protocol/CAS-Protocol-Specification.html"rel="nofollow">CAS protocol</a> versions 1.0, 2.0 and part of 3.0 (attributes exchange).
In the Manager, go in <code>General Parameters</code> » <code>Issuer modules</code> » <code><abbrtitle="Central Authentication Service">CAS</abbr></code> and configure:
</p>
<ul>
<liclass="level1"><divclass="li"><strong>Activation</strong>: set to <code>On</code>.</div>
</li>
<liclass="level1"><divclass="li"><strong>Path</strong>: keep <code>^/cas/</code> unless you have change <ahref="configlocation.html#portal"class="wikilink1"title="documentation:2.0:configlocation">Apache portal configuration</a> file.</div>
</li>
<liclass="level1"><divclass="li"><strong>Use rule</strong>: a rule to allow user to use this module, set to 1 to always allow.</div>
</li>
</ul>
<divclass="notetip">For example, to allow only users with a strong authentication level:
</div><divclass="noteimportant">Rewrite rules must have been activated in <ahref="configlocation.html#portal"class="wikilink1"title="documentation:2.0:configlocation">Apache portal configuration</a> or in <ahref="configlocation.html#portal1"class="wikilink1"title="documentation:2.0:configlocation">Nginx portal configuration</a>.
</div>
<p>
Then go in <code>Options</code> to define:
</p>
<ul>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> login</strong>: the session key used to fill user login (value will be transmitted to <abbrtitle="Central Authentication Service">CAS</abbr> clients).</div>
</li>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> attributes</strong>: list of attributes that will be transmitted in validate response. Keys are the name of attribute in the <abbrtitle="Central Authentication Service">CAS</abbr> response, values are the name of session key.</div>
</li>
<liclass="level1"><divclass="li"><strong>Access control policy</strong>: define if access control should be done on <abbrtitle="Central Authentication Service">CAS</abbr> service. Three options:</div>
<ul>
<liclass="level2"><divclass="li"><strong>none</strong>: no access control, the server will answer without checking if the user is authorized for the service (this is the default)</div>
</li>
<liclass="level2"><divclass="li"><strong>error</strong>: if user has no access, an error is shown on the portal, the user is not redirected to <abbrtitle="Central Authentication Service">CAS</abbr> service</div>
</li>
<liclass="level2"><divclass="li"><strong>faketicket</strong>: if the user has no access, a fake ticket is built, and the user is redirected to <abbrtitle="Central Authentication Service">CAS</abbr> service. Then <abbrtitle="Central Authentication Service">CAS</abbr> service has to show a correct error when service ticket validation will fail.</div>
</li>
</ul>
</li>
<liclass="level1"><divclass="li"><strong><abbrtitle="Central Authentication Service">CAS</abbr> session module name and options</strong>: choose a specific module if you do not want to mix <abbrtitle="Central Authentication Service">CAS</abbr> sessions and normal sessions (see <ahref="samlservice.html#saml_sessions_module_name_and_options"class="wikilink1"title="documentation:2.0:samlservice">why</a>).</div>
</li>
</ul>
<divclass="notetip">If <code><abbrtitle="Central Authentication Service">CAS</abbr> login</code> is not set, it uses <code>General Parameters</code> » <code>Logs</code> » <code>REMOTE_USER</code> data, which is set to <code>uid</code> by default