Authentifizierung über einen CAS-Server (SSO)

Diese Seite ist noch nicht vollständig übersetzt.

Siehe en:CAS server (SSO)

CAS is "Single Sign-on for the Web" and is developed by JA-SIG in an open-source, collaborative manner. CAS is very beneficial in environments where a number of different web applications share a set of common users. If all the web applications were "CASified" a user would log in once and would then be able to move between the various web applications without ever having to present authentication credentials again. CAS is similar to the Shibboleth authentication mechanism, but it is vastly simpler to set up and lacks a number of broader features like federated trust and authorization infrastructure.

The details for how CAS works are well documented, but CAS essentially works by configuring a web application (moodle.example.com) to not do authentication itself, but to instead forward unauthenticated users to a "CAS Server" (cas.example.com) which will then return an authentication token to the original web application (moodle.example.com). Moodle can extract the username from the token and then use its internal authorization mechanisms (roles, enrollments, capabilities) and user attributes (name, picture, etc.). The advantage is that the moodle.example.com service never has to handle passwords and that users, once they've authenticated the first time, can move seamlessly to another web application without having to present their credentials again.

Bemerkung: Assuming that you already have a working CAS server, configuration is fairly straightforward through the web interface.

One caveat for those converting from LDAP or other authentication mechanisms:

• For any user that you wish to authenticate with CAS but which already has been using Moodle, and thus has an entry in the Moodle database, you will need to change the value of the "auth" field for the user in the mdl_user table. So, if they used LDAP before, but now you wish for them to use CAS and their username is "foobar" you'll need to edit the database with some SQL something like: UPDATE mdl_user SET auth='cas' where auth='ldap' and username='foobar'; Without this change the user will constantly be presented with a failed login message, but otherwise no clue as to why login failed even though their credentials were accepted by the CAS server.

Aktivierung

Die Aktivierung der Authentifizierung über einen CAS-Server erfolgt auf der Seite

• Website-Administration > Nutzer/innen > Authentifizierung > Übersicht (ab Moodle 1.9)
• Website-Administration > Nutzer/innen > Authentifizierung (bis Moodle 1.9)

Klicken Sie in der Liste auf das geschlossene Auge-Symbol in der Zeile CAS-Server (SSO).

Spezifische Einstellungen

Spezifische Einstellungen für die Authentifizierung über einen CAS-Server nehmen Sie auf folgender Seite vor:

• Website-Administration > Nutzer/innen > Authentifizierung > Übersicht > E-Mail basiert > Einstellungen (ab Moodle 1.9)
• Website-Administration > Nutzer/innen > Authentifizierung > E-Mail basiert > Einstellungen (bis Moodle 1.9)

Im einzelnen können Sie folgendes konfigurieren:

LDAP Server-Einstellungen

Desweiteren müssen Sie Einstellungen für den LDAP-Server vornehmen. Dies erfolgt analog zu den Einstellungen bei Authentifizierung über LDAP.

Siehe auch

• Authentifizierung
• Module für die Authentifizierung verwalten