Module cas_auth 

CAS authentication plugin (cas-auth).

Port of the ticket-validation step of APISIX’s cas-auth plugin, with an optional interactive CAS SSO login flow layered on top via the shared encrypted-cookie session primitive.

Two modes

• Stateless (default) — when no session secret is configured the node behaves exactly as before: a request carrying a CAS service ticket query parameter is validated against the CAS server’s /serviceValidate endpoint and, on success, the authenticated user is attached to the request; anything else is rejected with CAS_AUTH_FAILED (401).
• Interactive (opt-in) — set session.secret (or session_secret) to turn on the full browser login flow. The authenticated user is sealed into an encrypted client-side cookie (no server-side session store), so the node can redirect unauthenticated browsers to the IdP’s /login, consume the returned ticket at the callback, and thereafter authenticate requests straight from the cookie. See the three-branch logic in CasAuthPlugin::execute_interactive.

Redirect wiring (interactive mode)

A 302 produced by this node (login redirect, post-callback redirect, or logout) is returned as an Err carrying the prepared response with code CAS_REDIRECT, following the same early-exit convention as the fault-injection/mocking nodes. Wire the node’s error edge to client.in so the redirect reaches the browser; the success edge carries authenticated requests on to the upstream.

Structs

CasAuthPlugin

Validates CAS service tickets and, in interactive mode, runs the SSO flow.

CasSession 🔒

Session payload sealed into the CAS session cookie (interactive mode).

Functions

build_login_url 🔒

Builds the CAS /login?service=<service> URL used to begin interactive login.

build_validate_url 🔒

Builds the CAS /serviceValidate URL.

extract_ticket 🔒

Reads the CAS ticket from the request’s query parameters.

extract_xml_tag 🔒

Returns the trimmed text between the first <tag> and its </tag>.

parse_service_validate 🔒

Extracts the authenticated username from a CAS /serviceValidate response.

percent_encode 🔒

Percent-encodes a query-argument value (RFC3986 unreserved chars kept).

session_cookie_str 🔒

Reads a string field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_cookie_u64 🔒

Reads a u64 field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_secret 🔒

Reads the session secret from session_secret or nested session.secret.