Implement CAS Protocol Support for Single Sign-On Integration

[Copilot]

This PR implements comprehensive support for the Central Authentication Service (CAS) protocol in UAAA, providing single sign-on (SSO) capabilities for web applications that use CAS instead of OAuth2/OpenID Connect.

What's New

CAS Protocol Implementation

• Complete CAS 3.0 protocol support following the official specification
• XML and JSON response formats for service validation
• Service ticket generation and validation with automatic expiration (5 minutes)
• Single logout support for coordinated session termination

New Endpoints

• GET/POST /cas/login - CAS login endpoint with service parameter
• GET /cas/serviceValidate - Ticket validation endpoint (CAS 2.0/3.0)
• GET /cas/p3/serviceValidate - Alternative CAS 3.0 validation endpoint
• GET/POST /cas/logout - Single logout endpoint

Integration Features

• Seamless UAAA integration - leverages existing authentication, session management, and user claims
• UI authorization flow support - works with the existing authorize page and supports remote/QR code authentication
• Security level enforcement - respects UAAA's security levels for claim filtering
• User attribute mapping - automatically maps user claims to CAS attributes

Usage Example

// Redirect user to CAS login
const serviceUrl = encodeURIComponent('https://myapp.example.com/protected')
window.location.href = `https://auth.example.com/cas/login?service=${serviceUrl}`

// Validate returned ticket
const response = await fetch(
  `https://auth.example.com/cas/serviceValidate?service=${serviceUrl}&ticket=${ticket}&format=JSON`
)
const data = await response.json()

if (data.serviceResponse.authenticationSuccess) {
  const user = data.serviceResponse.authenticationSuccess.user
  const attributes = data.serviceResponse.authenticationSuccess.attributes
  // User is authenticated
}

Response Formats

Success Response (XML)

<?xml version="1.0" encoding="UTF-8"?>
<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
  <cas:authenticationSuccess>
    <cas:user>john.doe</cas:user>
    <cas:attributes>
      <cas:email>john.doe@example.com</cas:email>
      <cas:name>John Doe</cas:name>
    </cas:attributes>
  </cas:authenticationSuccess>
</cas:serviceResponse>

Success Response (JSON)

{
  "serviceResponse": {
    "authenticationSuccess": {
      "user": "john.doe",
      "attributes": {
        "email": "john.doe@example.com",
        "name": "John Doe"
      }
    }
  }
}

Architecture

The CAS implementation follows the same architectural patterns as the existing OAuth2/OIDC implementation:

• CASManager - Core protocol logic (similar to OAuthManager)
• casRouter - HTTP endpoint definitions (similar to oauthRouter)
• CASConnector - UI integration for authorization flows
• Database integration - Extends token model for CAS tickets

Files Added

• packages/server/src/cas/_common.ts - CAS protocol manager
• packages/server/src/cas/index.ts - CAS HTTP endpoints
• packages/server/test/cas.test.js - Test coverage
• docs/cas-protocol.md - Protocol documentation
• docs/cas-examples.md - Integration examples

Files Modified

• packages/server/src/index.ts - App integration
• packages/server/src/api/session/index.ts - Ticket generation endpoint
• packages/server/src/db/model/token.ts - CAS ticket fields
• packages/ui/app/composables/useAuthorize.ts - UI connector
• README.md - Feature documentation

Testing

The implementation includes comprehensive test coverage and has been validated with manual testing. All existing functionality remains unchanged.

Security Considerations

• Service tickets are single-use and expire after 5 minutes
• Service URL validation is implemented (configurable allowlist recommended for production)
• Full integration with UAAA's security levels and permission system
• XML output is properly escaped to prevent injection attacks

This implementation enables organizations to integrate CAS-based applications with UAAA's unified authentication system while maintaining the same security standards and user experience as OAuth2/OIDC applications.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[cloudflare-workers-and-pages]

Deploying uaaa with    Cloudflare Pages

Latest commit:	b6bea7e
Status:	✅  Deploy successful!
Preview URL:	https://5b9c113e.uaaa.pages.dev
Branch Preview URL:	https://copilot-fix-3645b4c5-9230-45.uaaa.pages.dev

View logs