Service Access Strategy - REST

This strategy allows one to configure a service access strategy with the following properties:

The objective of this policy is to ensure a remote endpoint can make service access decisions by receiving the CAS authenticated principal as url parameter of a GET request. The response code that the endpoint returns is then compared against the policy setting and if a match is found, access is granted.

Here is an example of the remote endpoint access strategy authorizing service access based on response code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
  "@class" : "org.apereo.cas.services.CasRegisteredService",
  "serviceId" : "^https://app.example.org",
  "id" : 1,
  "accessStrategy" : {
    "@class" : "org.apereo.cas.services.RemoteEndpointServiceAccessStrategy",
    "endpointUrl" : "https://somewhere.example.org",
    "acceptableResponseCodes" : "200,202",
    "method": "GET",
    "headers": {
      "@class":"java.util.LinkedHashMap",
      "Content-Type": "application/json"
    }
  }
}

The request sent to the remote endpoint carries the principal id as a username parameter, and its body is a JSON document that describes the principal and the requested application:

1
2
3
4
5
6
7
8
9
10
11
{
  "principalId": "casuser",
  "attributes": { "role": [ "staff" ] },
  "service": { "id": "https://app.example.org/login" },
  "registeredService": {
    "id": 1,
    "name": "Example",
    "serviceId": "^https://app.example.org",
    "friendlyName": "CAS Client"
  }
}

The application definition itself is not sent, so that client secrets, keys and other credentials that it may carry are never disclosed to the remote endpoint.