Integrating CAS with an external SAML identity provider

Question

I would like to implement single sign on functionality for my web application(s).

Our team uses Spring framework, which seems to support CAS as its SSO authentication technology.

CAS seems to be very useful for managing local users, but (correct me if I'm wrong) its support for federated users via SAML seems to be lacking.

I would like to know if anyone has experience integrating CAS with an external SAML identity provider (such as Salesforce). i.e., an external company will do authentication of their users and let us know which users should have access, instead of us managing the users for them.

I've heard that Shibboleth could be used somehow into this architecture, but the only examples of CAS-Shibboleth integration I've seen are with Shibboleth as the identity provider, using CAS as the authentication provider. I need the authentication flow in the opposite direction.

Is this possible, and if so, how can I set this up?

Answer 1

I found the answer to my own question.

It is possible to have the CAS server act as a SAML service provider:

Sample code:

https://code.google.com/p/casshib/