# Single Sign-On Migration to CAS and Campus Data API Platform

Client: National Chung Hsing University
Updated: 2026-11-02

The legacy directory service was replaced with Apereo CAS and an OpenLDAP cluster without interrupting integrated systems; staff and student changes are now served through a single API platform. JIE HENG maintains the systems annually after acceptance.

## Background

The university's single sign-on ran on a legacy directory service with academic, student affairs, mail and library systems attached, some via OAuth2 and some only through proxy login. The university wanted an open-source, maintainable authentication platform and a single outlet for staff and student changes so individual systems would no longer query the administrative database themselves.

## Problems to solve

- Replace the legacy SSO without interrupting login on already-integrated systems.
- Authentication methods differed across systems; some could not be modified in the short term.
- Staff onboarding and departures and student enrollment and graduation were synchronized separately by each system, with inconsistent fields and timing.
- Authentication and data access had to meet university security rules: lockout on failed logins, log retention, encrypted transport.

## What JIE HENG did

**Authentication.** Deployed Apereo CAS with an OpenLDAP cluster, Redis sessions and a MongoDB log store behind a load balancer. CAS, OAuth2 and SAML are supported, so OAuth2 systems migrated directly while legacy systems kept proxy login until each unit could switch.

**Account migration.** Cleaned and migrated accounts and attributes from the old directory into the new LDAP, with scheduled jobs writing HR and enrollment changes into LDAP so account status follows administrative data.

**Portal.** Role-based menus for students, faculty and staff, with favorites, announcements, login history and single logout; idle timeout and lockout follow university policy.

**Password management.** Self-service reset and change with history; administrators set password policy, delegation scope and expiry reminders.

**Campus data API platform.** A separate database and API management platform synchronizes HR and enrollment changes, hourly at peak. Each consuming system receives only approved fields, controlled by token and IP, with every call logged.

## Outcome

- Integrated systems moved to the new platform with legacy systems bridged by proxy login; login stayed available throughout.
- Staff and student changes are served through the API platform by approved fields.
- Authentication, password changes and API calls are all logged and retained per policy.
- After acceptance the systems entered warranty, and JIE HENG continues annual maintenance of CAS, Portal and API.

## Maintenance

Annual maintenance covers CAS, Portal and API: issue handling, updates and security patches.

## What this means for enterprises

The enterprise equivalent is maintaining personnel data once and having every system's accounts and permissions follow onboarding and departures automatically.