Authentication Interrupt

CAS has the ability to pause and interrupt the authentication flow to reach out to external services and resources, querying for status and settings that would then dictate how CAS should manage and control the SSO session. Interrupt services are able to present notification messages to the user, provide options for redirects to external services, etc. A common use case deals with presenting a bulletin board during the authentication flow to present messages and announcements to select users and then optionally require the audience to complete a certain task before CAS is able to honor the authentication request and establish a session.

In the interrupt flow, CAS is not at the moment reaching back to an external resource acting as an interrupt service to store, track or remember a user’s decision. In other words, we are only dealing with the R (ie. Read) in CRUD. Today’s functionality only deals with inquiring status and reading results solely in read-only mode. Interrupt services are themselves required and encouraged to redirect the audience to external resources where execution of an action resets the interrupt status thereby freeing CAS to proceed forward later on without having to interrupt the authentication flow again.

Configuration

Support is enabled by including the following dependency in the WAR overlay:

1
2
3
4
5

<dependency>
  <groupId>org.apereo.cas</groupId>
  <artifactId>cas-server-support-interrupt-webflow</artifactId>
  <version>${cas.version}</version>
</dependency>

1

implementation "org.apereo.cas:cas-server-support-interrupt-webflow:${project.'cas.version'}"

1
2
3
4
5
6
7
8
9

dependencyManagement {
  imports {
    mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
  }
}

dependencies {  
  implementation "org.apereo.cas:cas-server-support-interrupt-webflow"
}

The following settings and properties are available from the CAS configuration catalog:

The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting may be needed to activate or affect the behavior of the CAS feature and generally should be reviewed, possibly owned and adjusted. If the setting is assigned a default value, you do not need to strictly put the setting in your copy of the configuration, but should review it nonetheless to make sure it matches your deployment expectations.

The configuration settings listed below are tagged as Optional in the CAS configuration metadata. This flag indicates that the presence of the setting is not immediately necessary in the end-user CAS configuration, because a default value is assigned or the activation of the feature is not conditionally controlled by the setting value. You should only include this field in your configuration if you need to modify the default value.

  • cas.interrupt.core.force-execution=false

    • Whether execution of the interrupt inquiry query should be always forced, and the status of interrupt check should be ignored. This is a global setting that can optionally be overruled for each application policy.

    org.apereo.cas.configuration.model.support.interrupt.InterruptCoreProperties.
  • cas.interrupt.core.trigger-mode=AFTER_AUTHENTICATION

    • Define how interrupt notifications should be triggered in the authentication flow. Available values are as follows:

    • AFTER_AUTHENTICATION: Trigger interrupt notifications and inquiry after authentication events and before single sign-on has been established.
    • AFTER_SSO: Trigger interrupt notifications and inquiry after single sign-on has been established. Interrupt queries that execute after single sign-on cannot control the creation of the SSO session conditionally.

    org.apereo.cas.configuration.model.support.interrupt.InterruptCoreProperties.