title: CAS and SAML2 SSO by example
body: <p>We have about a dozen internal admin web apps (mostly Java) that employees use for various workflows, and each of them have their own, disparate sign-in/authentication systems. I've been asked to federate them all together under a single sing-on system. I was handed the following diagram to use as a starting point:</p>
  
  <p><img src="https://i.stack.imgur.com/f3WWA.png" alt="enter image description here"></p>
  
  <p>As you can see, each app uses a CAS client to connect to a CAS server. This server also has Apache httpd with a Shibboleth plugin (?) configured. This CAS server then communicates with our Active Directory ("AD") server.</p>
  
  <p>I need to make sure I completely understand how these technologies all work together:</p>
  
  <ul>
  <li>What is happening between the CAS server and Apache/Shibboleth?</li>
  <li>What is happening between Apache/Shibboleth and the "Trust Store"?</li>
  <li>What is being communicated between the CAS server and AD?</li>
  <li>What is stored in this SAML2 token being sent back from the CAS server to each CAS client?</li>
  <li>How can I, as a Java developer, do with the SAML2 token (or lack thereof if auth fails) to actually sign users in with?</li>
  <li>Are there any better technology choices here: if so what are they, and why? Bear in mind that all of these are Java apps, except one of them, which is a C#.NET app.</li>
  </ul>