If you’re happy with this plugin :
As a reward for my efforts, I would like to receive T-shirts (or other goodies) as gifts from the universities or companies that use it.
My size is L. Best regards.

This Apereo CAS authentication plugin has no phpCas library dependency. This is not only an authentication plugin.
You can build custom authorization rules according to cas user attributes populated. If user don’t exist in WordPress
database, it can be created automatically. There are many features. You can customize everything.

Website

https://wpcassify.wordpress.com/

Development and release environment

This plugin is now developed and tested from a github repository. You can find it here :
https://github.com/WP-Cassify/wp-cassify-develop

Don’t hesitate to contribute to this project. You can fork it and make pull requests !

Requirements

Require at least PHP version 7.0
Require at least PHP CURL package

Features included

Manual CAS account marking (all accounts or by role) and inactive-account purge with a configurable period in days (730 by default), preview, optional inclusion of accounts without a login date, content reassignment and resumable batches. No scheduled deletion.
SLO (Single Log Out) support (thanks to dedotombo and me)
Adding NCONTAINS operator (thanks to blandman)
Fix bug on Gateway mode (autologin) (thanks to dedotombo again). Now it’s now necessary to hack theme files to fire it.
Adding option logout on authentication failure to not disturb users
Initialize PHP session at a later stage (on wp_loaded not on init)
Adding some customs hooks and filters.
Tested with Apereo CAS Server version 8.0.1.2
Compatible with CAS Protocol version 2 and 3
Automatic user creation if not exist in WordPress database.
Synchronize WordPress User metas with CAS User attributes.
Add support for multivaluate cas user fields. Now multivaluate fields can be serialized to be stored in custom WP User meta.
Backup / Restore plugin configuration options settings
You can choose CAS User attributes you want to populate. Then you can access them via PHP Session.

Be careful, to access to CAS User Attributes from your theme file (from 1.8.4), use code below :

<?php
    if ( isset($GLOBALS['wp-cassify']) ) {
        print_r( $GLOBALS['wp-cassify']->wp_cassify_get_cas_user_datas() );
    }
?>

Set up WordPress Roles to User according to CAS User attributes.
If plugin is network activated, you can define User Role Rule scope by blog id.
Authorization rule editor.
Compatible with WordPress Access Control Plugin.
Manage URL White List to bypass CAS Authentication on certain pages.

Much simpler bypass authentication with post method provided by Susan Boland (See online documentation). Create wordpress authentication form with redirect attribute like this (works only if URL bypass is enabled in settings) :

<?php

    $args = array(
        'echo'           => true,
        'remember'       => true,
        'redirect' => site_url( '/?wp_cassify_bypass=bypass' ),
        'form_id'        => 'loginform',
        'id_username'    => 'user_login',
        'id_password'    => 'user_pass',
        'id_remember'    => 'rememberme',
        'id_submit'      => 'wp-submit',
        'label_username' => __( 'Username' ),
        'label_password' => __( 'Password' ),
        'label_remember' => __( 'Remember Me' ),
        'label_log_in'   => __( 'Log In' ),
        'value_username' => '',
        'value_remember' => false
    );

    wp_login_form( $args ); 
?>

Receive email notifications when trigger is fired (after user account creation, after user login/logout).
Define notifications rules based on user attributes values.
Purge user roles before applying user role rules.
Define user account expiration rules bases on CAS User attributes.
Network activation allowed
You can set Service Logout URL (Needs to have CAS Server with followServiceRedirects option configured).
Add support for web application hosted behind a reverse proxy. (Thanks to franck86)
Add custom hooks : wp_cassify_after_cas_authentication, wp_cassify_before_auth_user_wordpress, wp_cassify_before_redirect, wp_cassify_after_redirect. (See online documentation)
Custom filter to perform custom cas server response parsing. Hook name : wp_cassify_custom_parsing_cas_xml_response (See online documentation)
Custom shortcode to generate CAS login/logout link into your blog. (See online documentation)
Debug settings, dump last xml cas server response.
Detect if user has already authenticated by CAS from your public pages and perform auto-login with gateway mode
Add ‘-IN’ and ‘-NOTIN’ operators to process array attributes values returned from CAS.
When you have :
```
$cas_user_datas['title'] = array( 'Student', 'Professor' );
```

Then you can use :

    (CAS{title} -IN "professor")

Manual account cleanup

Before every purge, make a complete backup of the database and all site files
(uploads, plugins, themes and configuration) and verify that it can be restored.
On multisite, back up the entire network. The backup checkbox is an administrator
acknowledgement: WP Cassify does not create or validate backups.

Cleanup is manual and requires a preview and confirmation. Administrators,
the operator, accounts with live WordPress browser sessions and accounts with
application passwords are excluded. The date tracks successful logins, not all
activity; authentication performed by third-party systems may not be tracked.
Accounts without a login date are kept unless explicitly included AND their
known CAS marking date is older than the selected period. No historical CAS
login dates are inferred when upgrading.

Content ownership is transferred in small steps and checked before deletion.
An interruption can leave partial transfers or removed site memberships; resume
or inspect the operation before starting another. Other plugins can delete their
own data through WordPress deletion hooks. Recreating a CAS account does not
restore the old WordPress identity or its data.

Task results show the date, operation type and counts of completed, skipped and
failed accounts. Previews are not retained in this history. Clearing a task keeps
its result summary and does not undo completed changes. Detailed execution events
are used internally for recovery until the task is cleared.

The database lock serializes Cassify requests only. Pause imports and other
writers during cleanup. All network sites are checked again before global
account deletion. During the final core deletion, attempts to delete posts,
attachments or links through the guarded WordPress APIs stop the operation.
This does not isolate concurrent authentication, direct SQL, direct file deletion
or arbitrary third-party hook side effects. Use a maintenance window and a
verified backup; this tool cannot guarantee preservation of third-party data.

The tools require WordPress 4.9+ and database connection-owned named locks;
unsupported locking fails closed. Multi-network installations are excluded.
No purge is scheduled or triggered by an upgrade. Inactivity is measured in
24-hour days (730 by default); a login exactly at the cutoff is retained.
Marking accounts manually changes their future purge eligibility and does not
prove their CAS identity. For accounts without a login date, the grace period
starts when their CAS marking date is first recorded.