Service Access Strategy - Permit.io

Permit.io offers permissions as a service, allowing developers to bake-in permissions and access control into applications quickly. It offers a centralized control panel, SDKs, APIs and microservices developers need to add to create a decision and enforcement points.

Support is enabled by including the following dependency in the WAR overlay:

1
2
3
4
5
<dependency>
    <groupId>org.apereo.cas</groupId>
    <artifactId>cas-server-support-permitio</artifactId>
    <version>${cas.version}</version>
</dependency>

1
implementation "org.apereo.cas:cas-server-support-permitio:${project.'cas.version'}"

1
2
3
4
5
6
7
8
9
dependencyManagement {
    imports {
        mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
    }
}

dependencies {
    implementation "org.apereo.cas:cas-server-support-permitio"
}

1
2
3
4
5
6
7
8
9
10
dependencies {
    /*
        The following platform references are included automatically and are listed for reference only.

        implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
        implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
        
    */
    implementation "org.apereo.cas:cas-server-support-permitio"
}

This access strategy attempts to sync the user with Permit.io, and then builds an authorization request and submits it to Permit.io. The specifics of the authorization request are taught to CAS using the settings typically defined within the access strategy itself:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "@class" : "org.apereo.cas.services.CasRegisteredService",
  "serviceId" : "^https://.+",
  "name" : "test",
  "id" : 1,
  "accessStrategy" : {
    "@class": "org.apereo.cas.permit.PermitRegisteredServiceAccessStrategy",
    "action": "...",
    "resource": "...",
    "apiKey": "...",
    "tenant": "default",
    "pdpAddress": "https://cloudpdp.api.permit.io",
    "emailAttributeName": "email",
    "firstNameAttributeName": "firstname",
    "lastNameAttributeName": "lastname",
    "context" : {
      "@class" : "java.util.TreeMap",
      "param1" : "value1"
    }
  }
}

The following fields are available to this access strategy:

_{[1] This field supports the Spring Expression Language syntax.}