CODEWITHSUNDEEP
javasingle-sign-oncas
Marinos An
Marinos An

Reputation: 10826

In CAS how can I restrict access to only one service if agreement is not yet accepted?

There is a requirement that the users should first accept some license agreement, which exists only in serviceA, in order to be able to login to all other services.

So the process should be:

Notes:
The code for services other than serviceA cannot be modified.
Also CAS has access to the agreement_accepted flag.

CAS Version used: 5.3.4

Upvotes: 3

Views: 548

Answers (1)

Misagh Moayyed
Misagh Moayyed

Reputation: 4318

Assuming agreement_accepted is an attribute for the authenticating user, you can design two access strategies, S1 and S2, that apply to service A and all other applications.

  • For S1, the strategy is the default in CAS where access to service A is granted without issues.
  • For S2, you can configure the strategy to only grant access to the application and allow CAS to issue a ticket, if agreement_accepted as an attribute has a value of, let's say, true.

Access strategies for services/applications are detailed here: https://apereo.github.io/cas/5.3.x/installation/Configuring-Service-Access-Strategy.html

See this as an example: https://apereo.github.io/cas/5.3.x/installation/Configuring-Service-Access-Strategy.html#enforce-attributes

You will need to make sure S2 is assigned to all other applications, except the record for Service A.

PS You may also consider bumping your CAS version to 5.3.8, which is the latest in 5.3.x as of this writing.

Upvotes: 4

Related Questions