---
title: "Rocket Chat CAS Authentication Setup Guide"
slug: "cas"
description: "Configure CAS authentication in Rocket Chat. Enable secure login, compliance, and reliable access management."
updated: 2025-12-31T07:25:36Z
published: 2025-12-31T07:25:36Z
canonical: "docs.rocket.chat/cas"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# CAS

Central Authentication Service (CAS) allows users to use one set of credentials to sign in to many sites over many protocols. Rocket.Chat includes a CAS plugin that allows you to use your existing CAS server for user authentication.

> [!NOTE]
> For more information on CAS, see the [CAS github repo](https://github.com/apereo/cas).

To access this setting, navigate to **Manage** ![Screenshot 2025-12-23 130522.png](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Screenshot%202025-12-23%20130522.png) > **Workspace** > **Settings** > **CAS**.

Your Rocket.Chat workspace is the *CAS client*. You must provide a compatible *CAS Server*.

Once you know your CAS server's URL, proceed with the settings below

- **Enabled**: Enable CAS on your workspace
- **SSO Base URL**: The base URL of your external SSO service, e.g `https://sso.example.undef/sso/`
- **SSO Login URL**: The login URL of your external SSO service, e.g `https://<<CAS_server_url>>/cas/login`
- **CAS Version**: Only use a supported CAS version supported by your CAS SSO service, e.g `(1.0|2.0)`

The `/cas` and `/cas/login` URLs are defaults but not mandatory. Check with your CAS server provider if the defaults do not work.

- **Trust CAS username**: When enabled, Rocket.Chat trusts that any username from CAS belongs to the same user on Rocket.Chat. This may be needed if a user is renamed on CAS, but may also allow people to take over Rocket.Chat accounts by renaming their own CAS users.
- **Allow user creation**: Allows CAS user creation from data provided by the CAS ticket when enabled.

### Attribute handling

- **Always Sync User Data**: When set to true, external CAS user data is synchronized into available attributes upon login. Note that attributes are always synced upon account creation anyway.
- **Attribute Map**: Use this JSON input to build internal attributes (key) from external attributes (value). External attribute names enclosed with '%' are interpolated in value strings.

Example, `{"email":"%email%", "name":"%firstname%, %lastname%"}`

The attribute map is always interpolated. In CAS 1.0, only the `username` attribute is available. Available internal attributes are username, name, email, and rooms; rooms are a comma-separated list of rooms to join upon user creation, e.g.: `{"rooms": "%team%,%department%"}` would join CAS users on creation to their team and department channel.

### CAS login layout

- **Login Popup Width**: Lets you set the width in `px` of the pop-up screen during login.
- **Login Popup Height**: This lets you set the popup height in `px`.
- **Login Button Label**: Set the button's label.
- **Login Button Text Color**: Sets the button text color
- **Login Button Background Color**: Sets the button background color
- **Autoclose Login Popup**: When enabled, the pop-up automatically closes after authenticating.

Click **Save changes** once you are done.

After successful configuration, your registration and login screens have the CAS button available.

> [!NOTE]
> - It is recommended that you use a **Trusted CA Signed SSL Certificate**.
> - Any Drupal 7 or 8 sites can serve as a compatible CAS Server. To learn more, see the [Drupal project guide](https://www.drupal.org/project/cas).