Apereo CAS Access Strategy

This article will demonstrate how to create an Apereo CAS Access Strategy for customized authorization rules to specific registered services.

The examples below assume you already have json registered services configured. The accessStrategy will be included in your json service.

Access strategies may be based on:

• Attributes
• Custom groovy scripts
• Grouper
• HTTP
• REST
• OpenFGA
• Permit.io
• Open Policy Agent
• and more…

Access Strategy – Attribute based

This example used the DefaultRegisteredServiceAccessStrategy and rejects authorization if the user has a specific attribute.

• enabled – This service is enabled. If you wish to disable a service altogether without deleting it, change this to false.
• ssoEnabled – When set to false, this will require the service to be logged in to each time it is accessed. When set to false, other services will still work with Single Sign On (SSO) even if this service was logged in to first. If a registered saml service, this is effectively the same thing as renew=true in a CAS service.
• unauthorizedRedirectUrl – The url to redirect users to if they fail authorization.
• rejectedAttributes – In this case, users with the affiliation attribute set to student will be denied access.

"accessStrategy": {
    "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
    "enabled": true,
    "ssoEnabled": false,
    "unauthorizedRedirectUrl": "https://example.com",
    "rejectedAttributes": {
      "@class": "java.util.HashMap",
      "affiliation": [
        "java.util.HashSet",
        [
          "student"
        ]
      ]
    }
  }

Access Strategy – IP Based

This example uses the HttpRequestRegisteredServiceAccessStrategy and requires the user to be coming from a specific IP address range based on the given regex.

• ipAddress – regex of required IP addresses
• userAgent – regex of required user agents
• headers – regex of required headers

"accessStrategy" : {
    "@class" : "org.apereo.cas.services.HttpRequestRegisteredServiceAccessStrategy",
    "ipAddress" : "10.\\d\\d\\d.\\d\\d\\d.10",
    "userAgent": "Chrome.+",
    "headers":{
      "@class": "java.util.TreeMap",
      "Header1": "Value.+Pattern"
    }
  }

Multiple Access Strategies

This example uses the ChainingRegisteredServiceAccessStrategy and can chain authorization requirements based on an operator of AND or OR.

"accessStrategy": {
    "@class": "org.apereo.cas.services.ChainingRegisteredServiceAccessStrategy",
    "strategies": [
      "java.util.ArrayList",
      [
        {
          "@class": "org.apereo.cas.services.HttpRequestRegisteredServiceAccessStrategy",
          "ipAddress" : "10.\\d\\d\\d.\\d\\d\\d.10",
          "userAgent": "Chrome.+",
          "headers":{
            "@class": "java.util.TreeMap",
            "Header1": "Value.+Pattern"
          }
        },
        {
         "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
         "enabled": true,
         "ssoEnabled": false,
         "unauthorizedRedirectUrl": "https://example.com",
         "rejectedAttributes": {
           "@class": "java.util.HashMap",
           "affiliation": [
             "java.util.HashSet",
             [
               "student"
             ]
           ]
         }
        }
      ]
    ],
    "operator": "AND"
  }

Conclusion – Apereo CAS Access Strategy

This article has demonstrated how to configure a custom access strategy in Apereo CAS. Let us know in the comments if you would like to see more advanced examples of access strategies and how to chain them. If you found this article helpful, read more of our content on Apereo CAS.