Central Authentication Service Integration 2.0 Administration Guide May 2014

Transcription

1 Central Authentication Service Integration 2.0 Administration Guide May 2014 Contents Purpose of this document About CAS Compatibility New features in this release Copyright 2014 Desire2Learn Incorporated. Desire2Learn, D2L, and the molecule logo are trademarks of Desire2Learn Incorporated, registered in the U.S. and other countries.

2 Purpose of this document This document intends to provide administrators an overview of Desire2Learn s Central Authentication Service (CAS) Integration solution and identify required configurations. About CAS CAS is a single sign-on protocol for the web. Its purpose is to allow users access to multiple applications while providing their credentials (For example, username and password) only once. It also allows web applications to authenticate users without gaining access to their security credentials. The name CAS also refers to the external software package that implements this protocol. The CAS Integration 2.0 from Desire2Learn allows an organization to integrate their CAS installation with Learning to establish centralized authentication. Compatibility CAS Integration 2.0 is compatible with the following: Learning 10.4 Note In 10.4, CAS Integration is managed from Learning s Customization Configuration Settings page. Administrators must have the Manage Custom permission enabled, and the Customization Configuration UI link added to the navbar to access the tool. Click Configuration UI on the navbar to access the page. Learning 10.3 Learning 10.2 Learning 10.1 CAS protocol 2.0 Customization New features in this release /Debugging: Administrators can see things such as when a server connection is failing, or which users fail to authenticate. All configurations are now in the Desire2Learn maintained database table _CS_CONFIG_SETTINGS. CAS Integration can be toggled on or off by Desire2Learn Incorporated. 2

3 CAS can be tested while the tool is disabled so users are not disrupted during initial tool configuration and testing. Client Side Client CAS server Client Login Page User Logs In User navigates to Learning Learning Does the user have a Client CAS ticket? NO Desire2Learn SSO validation YES Learning Users will access the native Learning login page. If the user is already authenticated within the institution s CAS network, Desire2Learn will not ask the user to authenticate again. If required, Desire2Learn will pass the user to the client CAS server to authenticate and redirect back to the Learning. Note: This solution supports deep linking. Users can be directed to a page deep in the Learning (For example, a discussion post, or a quiz) and, if they are not authenticated within the institution s CAS network, they can login and be directed deep within the Learning based on the intended target URL by Desire2Learn Incorporated. 3

4 Assembly D2L.Custom.CAS The following _CS_CONFIG_SETTINGS config keys need to be set for the CAS Integration 2.0: INACTIVE_USER_URL In cases where a valid CAS user is found but is mapped to a user in the Learning that is inactive, access cannot be granted and the user will be redirected to this URL in order to be provided the appropriate error and action steps. LOGIN_TYPE The type of login used for the data provided in the CAS <username> field. Valid configurations are: UserName or OrgDefinedId LOGIN_URL The URL to reach the Learning login page. Configured as /login.asp for most common deployments. This value is appended to the base URL of the Learning. LOGOUT_URL The URL the user is directed to after logging out of Learning. This is normally used to direct the user to the CAS implementation logout page. Assembly D2L.Custom.CAS.StandardValidator The following _CS_CONFIG_SETTINGS config keys need to be set for the CAS.StandardValidator plugin if activated: CAS_HOST_URL The URL of the CAS implementation login page Normally it will be CAS_SERVICEVALIDATE_URL The URL of the CAS implementation ServiceValidate route Normally it will be This is defined by the client only if it needs to change. Assembly D2L.Custom.CAS.DelimitedUserNameValidator The following _CS_CONFIG_SETTINGS config keys need to be set for thecas.delimitedusernamevalidator plugin if activated: CAS_HOST_URL 2013 by Desire2Learn Incorporated. 4

5 The URL of the CAS implementation login page Normally it will be CAS_SERVICEVALIDATE_URL The URL of the CAS implementation ServiceValidate route Normally it will be This is defined by the client only if it needs to change. RESPONSE_DELIMITER The character delimiter used to separate tokens within the CAS <username> field. This is not typically required unless the parameter supplied from the CAS server requires parsing in order to map to the user identifier within the Learning. This is defined by the client if required. RESPONSE_TOKEN_LOCATION The 0-based index to the token in the delimited string, used as the login credential. If the RESPONSE_DELIMITER is set, this value must point to the indexed value used as the user identifier once the value has been parsed into it s elements. For example, If the response from the CAS server upon login attempt = username123 asdf2314 RESPONSE_DELIMITER = RESPONSE_TOKEN_LOCATION = 2 (note the 0 based index) USERNAME = username123 All integration log information is available within Learning s System Log. This will include various messaging as an Error, Warning, Information, Debug or Fatal message. Filtering using CAS will provide any integration messages within the specified date and message by Desire2Learn Incorporated. 5