Zimbra multitenant CAS SSO?

[xiebo]

According to https://wiki.jasig.org/display/CAS/CASifying+Zimbra+6.0, in order to let Zimbra support CAS SSO, DOMAIN_KEY has to be hardcoded into preauth.jsp.

But Zimbra multitenant has multiple domains and then has multiple DOMAIN_KEY. How to deal with Zimbra multitenant CAS SSO?

[xiebo]

Any idea for this situation?

[kruon]

Do you have single master domain, to which all accounts belong?
If not, can you add single master domain and simply use the tenants as domain alias, but using the aliased domain as primary?

Then your single master domain would provide the authentication base for all the tenants.

Another approach could be something like:
zmprov md yourdomain.com zimbraWebClientLoginURL https://zimbra.url.comort/zimbra/public/preauth.jsp
zmprov md anotherdomain.com zimbraWebClientLoginURL https://zimbra.url.com:port/zimbra/p...herpreauth.jsp
zmprov md yourthirddomain.com zimbraWebClientLoginURL https://zimbra.url.com:port/zimbra/p...irdpreauth.jsp

[xiebo]

I could not do "add single master domain and simply use the tenants as domain alias" because "account@domain1.com" and "account@domain2.com" are different accounts.

[kruon]

Then you have to use the another approach I suggested, it's actually much easier to do than mass-aliasing now that I think about it.

[xiebo]

Currently preauth generates one preauth code for one domain. Is it possible to use one preauth code for all domains?

[kruon]

Preauth is domain specific since it contains the domainkey.
You need own preauth for each domain.
Stack them in web.xml, something like:

<filter-mapping>
    <filter-name>CasAuthenticationFilter</filter-name>
    <url-pattern>/public/preauth.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>CasAuthenticationFilter</filter-name>
    <url-pattern>/public/anotherpreauth.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>CasAuthenticationFilter</filter-name>
    <url-pattern>/public/thirdpreauth.jsp</url-pattern>
</filter-mapping>