I might add that additionally, I’ve run SPNEGO enabled CAS servers on both Linux and Mac OS X using a Windows AD KDC and LDAP in the backend for authentication and metadata so you can do that as well.
You need to keep your host-realm mapping in mind though, so client hosts consider the CAS server to be in the proper realm. In the basic case, this means placing the CAS host in the same DNS domain as the KDC in order to be covered by the AD kerberos service records in DNS. /Fredrik 10 dec. 2015 kl. 22:36 skrev Fredrik Jönsson <[email protected]<mailto:[email protected]>>: There is no major difference, the Kerberos bits are handled with Java and JAAS regardless of hosting platform and KDC. You create a service principal in AD, get a srvtab using a Windows command and configure your server to use it. We are doing exactly this, even in conjunction with a UNIX based realm with a trust. These docs may be slightly outdated, but are still mostly valid. https://wiki.jasig.org/plugins/servlet/mobile#content/view/2424990 Regards, /Fredrik -- Fredrik Jönsson, M.Sc. System Architect KTH/UF/ITA/Infosys E-mail: [email protected]<mailto:[email protected]> Phone: +46 8 790 6603 10 dec. 2015 kl. 20:39 skrev Michael Witschke <[email protected]<mailto:[email protected]>>: Hi, is there something planned to implement SPNEGO support for CAS running on Windows? The current implementation is for a UNIX system running MIT kerberos. I couldn't find anything for a pure Windows implementation that makes use of the Windows environment. I have AD integration with LDAP working fine but I have to enter my Windows credentials again on the CAS login screen. I would be nice if that can be omitted making use of the kerberos ticket to have a real SSO user experience. Thanks, Michael -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/.
