CAS support is based on deprecated library in Shiro

[rfrovarp]

The CAS support in this library is based on a library that Shiro has deprecated. They say go use buji-pac4j. So I'm trying to figure that out. I saw a different issue that was closed pointing someone with a SAML request at federated accounts, so I'm going to look at that path.

Not sure where or if you CAS support updated somewhere in the pair of projects or not. Once I get it figured out, I'll be happy to provide pull requests at the right location, or post independently as an example if CAS support is removed altogether from the two projects.

[kaosko]

Yeah, that's Jérôme's (jleleu's) work and we thought it'd evolve faster on its own than as part of Shiro. It's been a while though (I voted jleleu in as a committer to Shiro in 2015) so to be honest, I'm not sure where exactly things stand now. Federated accounts would likely work as a base but you'd need to create a custom integration for CAS yourself. There's a pac4j-oauth sample (https://github.com/tynamo/tynamo-federatedaccounts/blob/master/tynamo-federatedaccounts-test/src/test/java/org/tynamo/security/federatedaccounts/testapp/services/AppModule.java) but your mileage with cas might vary.

[rfrovarp]

Between that, the demo Buji app, and a lot of stepping through to see what was doing what, I have it more or less working in my own code. I need to add in symbols and figure out how to do the redirect to last page usefully (might be in the federated accounts code, haven't look through it for that, I was just trying to get the main CAS bits working).

The other thing I noticed is that the master branch in Shiro doesn't even have CAS code. So depending on how that project operates (you know way better than I), it might be removed from the next version Shiro, which will mean it needs to be removed or reworked here. And given what I've done, reworked elsewhere is something I can help out with.

[kaosko]

Glad to hear. You can get ideas from federatedaccount samples but it's still on you to do the redirect. The overall direction of Shiro is not to include (or drop) integrations to let the core evolve independently from supporting code and modules with many different auth providers.