Use Shibboleth instead of CAS for Authentication

[escowles]

Shibboleth would let us get more info on users, including whether they are faculty/staff/students and also access to metadata such as "employee type" which would help us better recognize and offer services to our many affiliate user groups outside of fac/staff/students.

[kevinreiss]

• [ ] Add Shibboleth/SAML Support to the Catalog via gems? - need to research options
• [ ] Work with OIT's IAM (Identity and Access Management) Group to set up catalog-staging and catalog-production as trusted endpoints with our campus shibboleth IDP at https://idp.princeton.edu/idp/shibboleth.
• [ ] Identify a strategy for local testing of Shibboleth Authentication/Authorization. - need to research options
• [ ] Make sure a successful shib response includes the attribute urn:oid:1.2.840.113556.1.2.613/employeeType" which is not part of the standard set of attributes released via Shib. The groupings in this value are what we use to determine access to electronic resources.
• [ ] Update Borrow Direct authorization route to allow only appropriate employee type groups to access Borrow Direct.
• [ ] Update Request gem to allow pick-up, in library use, and digitization requests only by appropriate employee type groupings.

[kevinreiss]

OIT is planning to sunset CAS as an authentication option sometime in the next two years in favor of Shibboleth or the MS SSO option (need name). When we have more details on this we can create new epic ticket that can use some of the action items above.