Organisation administration · Public
Configure CAS applications
Register CAS connected applications in IAM, set every required field, and hand integrators the credentials they need.
CAS applications let members sign in to connected software through Skyfallen ONE. Administrators register each application in IAM so ONE knows where to send users after consent and how long codes and sessions remain valid.
This guide covers IAM configuration. For the authorization-code flow and IDMS API, see CAS sign-in and session API.
Prerequisites
If SSO → CAS Apps is missing from IAM, open Organisation and review Platform settings, or contact your Skyfallen Account Manager to enable CAS application management.
Members who sign in through CAS need the cas:auth permission on the tenant they select during consent. Grant that separately from cas:manage.
| Requirement | Details |
|---|---|
| Tenant type | Enterprise |
| Tenant toggle | CAS application management enabled by Skyfallen |
| Permission | cas:manage on your membership |
| Tenant status | Active |
Open CAS Apps
- Sign in at iam.skyfallen.one.
- Switch to the enterprise tenant you manage.
- Open SSO → CAS Apps.
Skyfallen managers can filter the list to one tenant or view all applications. Other administrators see only applications published by and accessible to their own tenant.
Create an application
Select New application. The form runs in five steps.
Save on the last step. ONE generates an App ID (UUID) and a secret.
Copy the secret immediately. It is shown only at creation and again after a reset. Store it server-side. Your integration uses it when exchanging authorization codes at idms.skyfallen.one.
| Step | Purpose |
|---|---|
| Application | Name and description shown during sign-in and on the workforce portal |
| Integration | Redirect URL for the browser callback |
| Legal | Privacy Policy and Terms of Service links shown during consent |
| Access | Publisher and accessible tenant (Skyfallen managers only) |
| Session | Authorization code and CAS session lifetimes |
Field reference
Application
For non-manager administrators, the publisher is your current tenant and cannot be changed on this step.
| Field | Required | Limits | Notes |
|---|---|---|---|
| Name | Yes | 255 characters | Display name in sign-in flows and the workforce portal. |
| Description | Yes | 5,000 characters | Short summary of what the application does for members. |
Integration
Send users to https://auth.skyfallen.one/authorise/cas/{APP_ID} to start sign-in. Replace {APP_ID} with the application's UUID. You can read the App ID when you edit the application.
| Field | Required | Limits | Notes |
|---|---|---|---|
| Redirect URL | Yes | Valid URL, 512 characters | Exact callback URL that receives ?code=... after consent. Must match the URL your integration uses. |
Legal
| Field | Required | Limits | Notes |
|---|---|---|---|
| Privacy Policy URL | Yes | Valid URL, 2,048 characters | Shown during consent. |
| Terms of Service URL | Yes | Valid URL, 2,048 characters | Shown during consent. |
Access
Visible to Skyfallen managers only. Other administrators publish applications only for their own tenant.
When publisher and accessible tenant differ, members of the accessible tenant sign in to an application owned by another tenant. Use this only when your operating model requires it.
| Field | Required | Notes |
|---|---|---|
| Publisher | Yes | Tenant that owns and publishes the application. |
| Accessible to tenant | Yes | Tenant whose members can sign in and grant consent. |
Session
Exchange authorization codes from your backend immediately. Codes are single-use.
| Field | Required | Range | Default | Notes |
|---|---|---|---|---|
| Code expiry (seconds) | No | 5–600 | 30 | Lifetime of the one-time authorization code returned to the redirect URL. |
| Session expiry (minutes) | No | 1–10,080 | 180 | Lifetime of the CAS session token returned from POST /api/cas/session. |
| Action | Where | Notes |
|---|---|---|
| Edit fields | Row actions → edit, or click the row | Redirect URL, legal links, and session values can change anytime. |
| Reset secret | Row actions → Reset secret | Invalidates the previous secret. Update every integration that stores it. |
| Remove application | Row actions → Remove | Deletes the CAS registration. Portal entries that reference it must be removed separately. |
Publish on the workforce portal
CAS applications do not appear on the workforce portal until you add them under Apps in IAM. Members with iam:apps can publish entries, set optional titles and groups, and upload icons.
See Publish apps on the workforce portal. Portal launch sends members to https://auth.skyfallen.one/authorise/cas/{APP_ID}.
Permission summary
Full definitions are in Tenant permissions reference.
| Permission | Who needs it | Purpose |
|---|---|---|
cas:manage |
IAM administrators | Create, edit, reset secrets, and delete CAS applications |
cas:auth |
Members using the application | Complete browser sign-in and grant consent |
iam:apps |
Portal administrators | Add the application to the workforce portal |