Apereo CAS Release Multi-Value Attribute

This article will demonstrate how to in Apereo CAS release a multi-value attribute. Each Service Provider (SP) is different in how they parse incoming attributes. Some may accept a comma delimited list and others may require multiple values for the same attribute.

By default, attributes such as memberOf in Active Directory (AD) should be sent as multi-value. It may not be as obvious how to release a custom attribute this way. This solution will make use of a custom groovy script for attribute computation and release configured in a registered service in the json service registry.

CAS JSON Service Config

This article presumes you already have a json service configured in your json service registry. For example:

  "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService",
  "serviceId": "example",
  "name": "example",
  "environments": [
    "java.util.HashSet",
    [
      "prod"
    ]
  ],
  "id": 1234,
  "metadataLocation": "file:/etc/cas/config/metadata/example.xml",
  "evaluationOrder": 1234,
  "requiredNameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "usernameAttributeProvider": {
    "@class": "org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider",
    "usernameAttribute": "emailAddress"
  },
  "attributeReleasePolicy": {
    "@class": "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy",
    "allowedAttributes": {
      "@class": "java.util.TreeMap",
      "role": "file:/etc/cas/config/groovy/example.groovy"
    }
  }
}

In this example, the role attribute being released is computed in an example.groovy script detailed below.

Custom Groovy Attribute Release

Here is a custom groovy script computing roles for a given user. In this example, the user’s group membership is not to be returned to avoid sending access data to a third party Service Provider (SP). Rather, roles are computed based on the group membership.

import java.util.*
def run(final Object... args) {
    def attributes = args[0]
    def roles = []
    if (attributes["memberOf"].join(", ").contains("CN=exampleA")) {
        roles.add("exampleA")
    }
    if (attributes["memberOf"].join(", ").contains("CN=exampleB")) {
        roles.add("exampleB")
    }
    return roles
}

In this script an array of roles is being returned. CAS will translate the array into multiple AttributeValue elements in the role Attribute. In the SAML response, the role attribute will look like this.

<saml2:Attribute FriendlyName="role"
                             Name="role"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
       <saml2:AttributeValue>exampleA</saml2:AttributeValue>
       <saml2:AttributeValue>exampleB</saml2:AttributeValue>
</saml2:Attribute>

Essentially, the roles variable would look like this if the user was a member of both groups.

roles = ['exampleA', 'exampleB']

Conversely, you could configure your script to simply return a comma delimited list which would return a string value in a single AttributeValue element.

Conclusion – Apereo CAS Release Multi-Value Attribute

In conclusion, this article has demonstrated how to release a multi-value attribute in a custom groovy script called by a registered service in the json service registry. Let us know in the comments if you have any questions. If you found this article helpful consider reading more of our content on the Apereo CAS IDP.