Sam,
Just fyi for yourself (and the list!) I don't work for QUT any longer so
this response is not on their behalf, just my recollection of events.
It is worth noting QUT did undertake a considerable review over 3 months
or so needs from all users inside the university and matching those
needs against solutions already present in the market (open and commercial).
Some brief reasons:
* The CAS protocol while 'open' is not a standard per say, its protocol
was also lacking in a few areas which we wanted to support (and was at
the time from memory undergoing to 1.0 to 2.0 change plain text to xml).
* SAML 2.0 covered all our needs for protocol/bindings support, security
and being an open standard. The standard itself has gone through lots of
rigorous assessment with lots of input from the wider community.
* It was considered talking to vendors we'd be more likely to see
support for SAML 2.0 SP's in software then CAS given the wide
deployments of SAML 2.0 in industry.
* There was a need for Attribute Exchange and Single Logout which are
natively specified in SAML 2.0
* QUT wanted to utilize XACML to provide really fine grained access
control for applications, there was already a SAML 2.0 profile to
support this, so we could leverage that in our implementation.
* QUT wanted to federate with other SAML supporting entities in higher
ed and industry. For example the Google Apps suite.
* A web management portal to control the entire identity deployment was
high on the list to allow application administrators to enable/disable
services and undertake crypto updates.
So it was agreed that the SAML path suited the business needs and ESOE
was moved forward.
I have heard recently that CAS now has some kind of SAML support though
I don't profess to be knowledgeable in how far they've taken this
support into their stack.
So both solutions are great at what they do and like anything both have
similarities and differences it just depends on needs of the business as
to which path is better suited for your own needs.
I hope that is of some help.
regards,
Bradley
--
Bradley Beddoes
Lead Software Architect
Intient Pty Ltd
http://www.intient.com
Sam wrote:
> Hi all,
> This is mainly directed at Bradley -
> I've been looking at various single sign-on and session management
> solutions. In looking at ESOE I can't help but see massive
> similarities to CAS. Is there any reason why QUT chose to develop ESOE
> vs. using/adapting CAS? I'm looking at the product in a university
> deployment context and would be keen to understand the reasons.
> Regards,
> Samuel Cochran
|
