Apereo CAS
Open-source single sign-on and identity provider for the web.
One login for all your applications, over CAS, SAML2, OAuth2 and OpenID Connect, with multifactor authentication built in.
Quick Start · Documentation · Releases · Support · Contribute
CAS is an enterprise, multilingual identity provider and single sign-on server. It started as the CAS protocol, an open and well-documented authentication protocol, and this repository holds its primary implementation: a Java server built on Spring Boot and Spring Cloud, with support for a plethora of authentication protocols and features. CAS is free and open source, managed by the Apereo Foundation and licensed under Apache 2.0.
Try It in a Minute
With Docker installed, start the official image, using a CAS version
tagged on Docker Hub in place of <version>:
docker run --rm -p 8080:8080 \
-e SERVER_SSL_ENABLED=false -e SERVER_PORT=8080 \
apereo/cas:<version>Open http://localhost:8080/cas/login and log in as casuser with the password Mellon.
When you are ready for your own server, the Quick Start takes you from here to a configured WAR overlay with a registered application in eight short steps, and Getting Started explains how to plan a deployment. You do not need to clone this repository to run CAS; that is only required to contribute to the project.
What CAS Does
| Area | Highlights |
|---|---|
| Protocols | CAS v1, v2 and v3, SAML v1 and v2, OAuth 2.0, OpenID Connect, OpenID for Verifiable Credentials, WS-Federation Passive Requester |
| Authentication | LDAP and Active Directory, RDBMS, X.509, SPNEGO, JAAS, RADIUS, JWT, MongoDB, Apache Cassandra, BASIC, Remote, Trusted, passkeys and passwordless login, and more |
| Delegated authentication | External SAML2, OpenID Connect, OAuth, CAS and WS-Federation identity providers, including social logins |
| Multifactor authentication | Duo Security, WebAuthn FIDO2, Google Authenticator, YubiKey, Simple MFA, RADIUS and more |
| Authorization | Heimdall, OpenFGA, Open Policy Agent, ABAC, time and date rules, REST, Internet2 Grouper and more |
| High availability | Ticket registries on Hazelcast, Redis, JPA, MongoDB, DynamoDb, Memcached, Apache Ignite and more |
| Application registration | Service registries on JSON, YAML, LDAP, JPA, MongoDB, DynamoDb, Redis, Google Cloud and more |
| User experience | Global and per-application themes, password management and policy enforcement, attribute release consent, notifications by email and SMS (Twilio, Mailgun, SendGrid, Amazon SES) |
| Integrations | Apache Syncope, SCIM, Shibboleth IdP, Keycloak, Okta, Swagger and more |
| Operations | Admin dashboards, monitoring, metrics, logging and audits; runs on embedded Apache Tomcat or Jetty, in Docker containers and on Kubernetes |
Documentation
| Version | Status | Docs |
|---|---|---|
development | Ongoing work toward the next release | Read |
8.0.x | Maintenance Release | Read |
7.3.x | Maintenance Release | Read |
Release dates and end-of-life schedules are in the Maintenance Policy and the release schedule. The Apereo blog covers new releases, how-tos and deployment stories.
Contribute
If you have identified an enhancement or a bug, please submit a pull request for it. There is no need to open a separate issue first: the pull request is the issue, and it is tracked and tagged as such. The contributor guide explains how the project works, and the build guide shows how to build CAS from source with JDK 25.
Support
Apereo CAS is 100% free open source software. The community has access to every release at no cost, and the time and effort to develop and maintain it are given by volunteers and contributors. If you or your employer benefit from CAS, please consider becoming a Friend of Apereo.
Questions are welcome on the mailing lists and Slack, where you will also find commercial support options. To report a security issue, please follow the security policy.