Background

The university's single sign-on ran on a legacy directory service with academic, student affairs, mail and library systems attached, some via OAuth2 and some only through proxy login. The university wanted an open-source, maintainable authentication platform and a single outlet for staff and student changes so individual systems would no longer query the administrative database themselves.

Problems to solve

  • Replace the legacy SSO without interrupting login on already-integrated systems.
  • Authentication methods differed across systems; some could not be modified in the short term.
  • Staff onboarding and departures and student enrollment and graduation were synchronized separately by each system, with inconsistent fields and timing.
  • Authentication and data access had to meet university security rules: lockout on failed logins, log retention, encrypted transport.

What JIE HENG did

Authentication. Deployed Apereo CAS with an OpenLDAP cluster, Redis sessions and a MongoDB log store behind a load balancer. CAS, OAuth2 and SAML are supported, so OAuth2 systems migrated directly while legacy systems kept proxy login until each unit could switch.

Account migration. Cleaned and migrated accounts and attributes from the old directory into the new LDAP, with scheduled jobs writing HR and enrollment changes into LDAP so account status follows administrative data.

Portal. Role-based menus for students, faculty and staff, with favorites, announcements, login history and single logout; idle timeout and lockout follow university policy.

Password management. Self-service reset and change with history; administrators set password policy, delegation scope and expiry reminders.

Campus data API platform. A separate database and API management platform synchronizes HR and enrollment changes, hourly at peak. Each consuming system receives only approved fields, controlled by token and IP, with every call logged.

Outcome

  • Integrated systems moved to the new platform with legacy systems bridged by proxy login; login stayed available throughout.
  • Staff and student changes are served through the API platform by approved fields.
  • Authentication, password changes and API calls are all logged and retained per policy.
  • After acceptance the systems entered warranty, and JIE HENG continues annual maintenance of CAS, Portal and API.

Maintenance

Annual maintenance covers CAS, Portal and API: issue handling, updates and security patches.

What this means for enterprises

The enterprise equivalent is maintaining personnel data once and having every system's accounts and permissions follow onboarding and departures automatically.

Kemas kini terakhir: 2026-11-02