SHSelfHostIndex

Apereo CAS vs Shibboleth Identity Provider

A side-by-side comparison of two self-hosted identity & sso options — licensing, setup difficulty, resource needs, and what each one replaces.

Not the right match-up?
AP Apereo CAS Enterprise single sign-on server for web applications VS SH Shibboleth Identity Provider Standards-based SAML identity provider for federations
FeatureApereo CASShibboleth Identity Provider
Deploy effortUnder-an-hour setupUnder-an-hour setup
CategoryIdentity & SSOIdentity & SSO
LicenseApache-2.0Apache-2.0
LanguageJavaJava
Setup difficultyHardHard
Min. RAM1,024 MB1,024 MB
Deploymentdocker, kubernetes, bare-metalbare-metal, docker, source
GitHub stars★ 11,376★ 200
First released20042003
ReplacesOkta, Ping IdentityOkta, Ping Identity

What are Apereo CAS and Shibboleth Identity Provider?

Apereo CAS

Apereo CAS is an open-source, enterprise single sign-on solution and identity provider. Widely used in higher education, it supports the CAS protocol along with SAML, OAuth2 and OpenID Connect.

  • CAS, SAML, OAuth2 and OIDC protocols
  • Multi-factor authentication
  • Pluggable authentication handlers
  • Delegated and federated authentication

Read the full Apereo CAS guide →

Shibboleth Identity Provider

The Shibboleth Identity Provider is an open-source SAML identity provider widely used in research and education federations. It enables secure single sign-on and attribute release across organizations.

  • SAML 2.0 identity provider
  • Attribute resolution and release policies
  • Federation metadata support
  • Used by academic federations worldwide

Apereo CAS vs Shibboleth Identity Provider: key differences

Both projects are written in Java. Apereo CAS has the considerably larger community, at 11,376 GitHub stars versus 200.

Why pick each one

Choose Apereo CAS if…

  • Mature SSO with broad protocol support
  • Widely adopted in academia

Watch out for

  • Configuration is involved
Apereo CAS details

Choose Shibboleth Identity Provider if…

  • Gold standard for SAML federations
  • Highly configurable

Watch out for

  • Complex setup
  • SAML-centric
Shibboleth Identity Provider details

Frequently asked questions

Is Apereo CAS or Shibboleth Identity Provider better?

Neither is universally better. Apereo CAS has the larger community; both share a hard setup difficulty, so the decision comes down to features and licensing.

Are Apereo CAS and Shibboleth Identity Provider free and open-source?

Yes. Apereo CAS is licensed under Apache-2.0 and Shibboleth Identity Provider under Apache-2.0. Both can be self-hosted at no software cost.

Can I run Apereo CAS and Shibboleth Identity Provider with Docker?

Apereo CAS: yes. Shibboleth Identity Provider: yes.

Related comparisons