Download websites that use Apereo CAS

About Apereo CAS

University single sign-on is one of the few pieces of authentication infrastructure a visitor is meant to see. The login page is public, it carries the institution's branding, and it usually lives on a hostname of its own, separate from the site that sent the user there. That architectural habit is what makes this software both detectable and badly undercounted.

A central authentication service is the front door to everything else an organisation runs. Mail, library systems, course platforms, grant portals and internal tools all delegate to it, so its presence implies an institution with many applications and a decision, taken centrally, that one identity should open all of them. Nobody deploys this class of software to protect a single site.

As of October 2026 we detect it on 10 hostnames. The number is small and the reason is structural rather than commercial. Login servers sit on subdomains that are rarely linked from a home page and often excluded from crawling, and many institutions place them behind a portal that only appears after a redirect. An organisation can run the software for tens of thousands of people and still surface once, or not at all, in a public web index. The figure is evidence of presence, not a measure of installed base.

The record here is unusually complete for a community project. The software is written in Java, distributed under Apache 2.0, and our first year for it is 2004, which makes it older than several of the identity protocols it now speaks. Stewardship sits with Apereo Foundation, a foundation rather than a company, and the governance model explains part of the deployment pattern. The code costs nothing to adopt, so the real price is staff time, and staff time is something a university has and a small business does not.

Category in our catalogue is Authentication, and for a researcher that label understates what a detection means. A site running its own Java identity server is telling you it did not buy a hosted login product, that it keeps an operations team, and that any vendor selling into it has to integrate with an existing federation rather than replace it. Security researchers read the same signal in reverse, because a self-operated front door is a patching obligation as well as an architecture, and the sites carrying one are worth watching when a relevant advisory lands.

A per-domain lookup answers whether one institution runs it. The exported list answers who else does, which countries and domain suffixes cluster, and which organisations would have to be approached with an integration story rather than a replacement pitch. Building that from single lookups would mean guessing the hostname of every login server on the internet first, which is not a research method so much as a hobby.