What is the relation between CAS vs SAML?

There is CAS, the protocol. Then there is CAS, the software implementing that protocol and many many others.

The software is located here: https://github.com/apereo/cas

Note the README: "CAS is an open and well-documented authentication protocol. The primary implementation of the protocol is an open-source Java server component by the same name, hosted here."

Many software products, like the Apereo CAS server, support more than one protocol at the same time. So the Apereo CAS software can support CAS, SAML2 and OAuth, etc protocols at the same time. The Shibboleth IdP for instance can support SAML2, SAML1 and CAS at the same time.

So your question of:

Aren't CAS and SAML different ways of how Single Sign-on can be implemented ?

Yes, they are different protocols in many ways providing or achieving the same thing.

Where exactly would CAS come in the above said set-up ?

The SAML server needs to also support the CAS protocol for that 3rd party website, or you need a separate CAS deployment that delegates authentication to the SAML server...or it's not happening.


While the accepted answer is accurate, it is incomplete. The CAS 3.0 (protocol) specification incorporates SAML 1.1 messages directly. They are used for interacting with the /SAMLvalidate endpoint as described here: https://apereo.github.io/cas/5.0.x/protocol/CAS-Protocol-Specification.html#42-samlvalidate-cas-30