cas

I've been a committer on Apereo CAS (https://github.com/apereo/cas) since the 3.0 days. It's an open-source SSO/identity platform - 400+ modules, Spring Boot 3.x, Java 21+. Deployed at thousands of universities, government agencies, and enterprises. I wrote a book that walks through how the whole thing works internally - not configuration, but actual code paths. 30 chapters, 825 pages. The Spring Boot bootstrap sequence, the authentication pipeline, Webflow state machines, ticket registry internals, SAML2/OAuth2/OIDC protocol engines.

CAS? https://www.apereo.org/projects/cas https://github.com/apereo/cas https://apereo.github.io/cas/6.4.x/index.html Also, floating around out there, somewhere, on the 'net, should be whatever became of the old Sun Identity Manager product. During the Jonathon Schwartz era, Sun made a TON of their products Open Source, but after the Oracle acquisition a lot of that stuff was left to more or less die on the vine. But in some cases, other firms picked up the code and continued the project(s). I think that happened for their Idm product, but don't quote me on that.

I don't think it's designed as a competitor to AD, but rather to smooth the AD-cloud user transition, especially as more and more companies buy into SaaS like O365/GApps, etc. You are right about SAML of course, but my point is how the lines between SSO/SAML etc and AD/LDAP etc are getting blured because companies want them to essentially work as a single unit. Here are a couple of the interesting alternatives in the arena: https://github.com/apereo/cas https://www.univention.com/products/ucs/ https://www.shibboleth.net/ https://wso2.com/ One of my planned side projects is to test each of these.

This is timely as I am literally just getting into working on the account management / login / registration stuff for a new app tonight. Most of this stuff isn't really new, but it's good to have a reminder, and/or validation of certain things. We're not (currently) doing 3rd party providers like Google / Twitter / Facebook, but since we have (well, will have) multiple independent apps out there, we have a CAS[1] server set up for SSO and all our apps use that for authentication. This current app is a little more complicated to deal with, since it's basically an "app for provisioning apps". So we have "login to the main site" level login, and then login / authorization for the stuff that gets provisioned. We also want to support things like "invite a user to join via email", etc. Still working on how exactly the user experience will