Central Authentication Server (CAS) SSO

Central Authentication Server (CAS) is an open-source single sign-on (SSO) protocol adopted by many educational institutions.  If your institution has already adopted the CAS framework for SSO purposes, you can authenticate a user on your network once, via some credentials (like username and password), and allow the user seamless access into Taskstream without the user ever knowing their Taskstream user credentials.

The setup is fairly straightforward.  A Taskstream CAS URL will need to be configured and supplied to your institution, while you would also need to provide your CAS URL to a Taskstream representative.

This is the expected CAS work-flow from your user's perspective:

The diagram shows the CAS authentication flow between the user’s browser, the institution’s CAS server, and the Taskstream CAS client, beginning with the user requesting access (1), the browser redirecting to CAS (2), and CAS requesting the logon page (3), if no CAS cookie exists (4a), the logon page showing, but if a cookie exists (4b), the flow skips ahead, the user enters a username and password (5), and then two branches occurs: when authentication succeeds (6a), CAS generates a Service Ticket, while on failure (6b) the flow looping back to the logon page (4a), the Service Ticket passing to the Taskstream CAS client (7), the browser posting an https validation request (8), and again two outcomes are occurring, if the ticket validates (9a), CAS returns success and the username attribute passes to Taskstream, but if the ticket is invalid (9b), the flow loops back to the earlier redirect step (2), after successful validation, Taskstream authorizes the username and displaying the main landing page to the user (10).

If you are interested in setting up CAS SSO integration into Taskstream, please click the Submit a Request button to open a ticket for the Support Team and provide your CAS URL in the description field.

Note: The Taskstream CAS solution does not automatically create new Taskstream accounts for a new user when they click the link from your portal/website.  You must provision the Taskstream accounts for any new users beforehand.  Please refer to this link for the various methods to provision Taskstream accounts.  If a new user clicks the link and does not have an existing Taskstream account to match against, the user will see an error message stating they do not have a Taskstream account and to contact their administrator.

Was this article helpful?
0 out of 0 found this helpful

Articles in this section

How to Contact Support
There are many ways to reach out! Click the icon above for our support options.
Watermark Academy
Click the icon above to access the Watermark Academy for consultation, training, and implementation companion courses.
Customer Community
Can’t find the answer? Ask fellow users how they’re making the most of Watermark in our Community!