Module cas_auth 

CAS authentication plugin (cas-auth).

Port of the ticket-validation step of APISIX’s cas-auth plugin, with an optional interactive CAS SSO login flow layered on top via the shared encrypted-cookie session primitive.

Two modes

• Stateless (default) — when no session secret is configured the node behaves exactly as before: a request carrying a CAS service ticket query parameter is validated against the CAS server’s /serviceValidate endpoint and, on success, the authenticated user is attached to the request; a missing ticket, or one CAS itself refuses, is rejected with a 401 on the denied port.
• Interactive (opt-in) — set session.secret (or session_secret) to turn on the full browser login flow. The authenticated user is sealed into an encrypted client-side cookie (no server-side session store), so the node can redirect unauthenticated browsers to the IdP’s /login, consume the returned ticket at the callback, and thereafter authenticate requests straight from the cookie. See the three-branch logic in CasAuthPlugin::execute_interactive.

Redirect wiring (interactive mode)

A 302 produced by this node (login redirect, post-callback redirect, or logout) exits on the dedicated redirect output port, following the same convention as the standalone redirect node. Wire the node’s redirect edge to client.in so the response reaches the browser; deliberate denials exit on denied (also wired to client.in, or a custom denial handler); the success edge carries authenticated requests on to the upstream.

The error port is live

Ticket validation is an outbound callout, so this node has a genuine failure mode: the CAS server unreachable, timed out, or answering /serviceValidate with a non-200. Those exit on error (see CasError and CasAuthPlugin::infra_error) — the node could not reach a verdict. Only a verdict of “this ticket is not valid” (or no ticket at all) is a denied.

Structs

CasAuthPlugin

Validates CAS service tickets and, in interactive mode, runs the SSO flow.

CasSession 🔒

Session payload sealed into the CAS session cookie (interactive mode).

Enums

CasError 🔒

Why a CAS ticket validation did not yield an authenticated user.

Functions

build_login_url 🔒

Builds the CAS /login?service=<service> URL used to begin interactive login.

build_validate_url 🔒

Builds the CAS /serviceValidate URL.

classify_validation 🔒

Classifies a /serviceValidate reply: a non-200 status is a provider failure (CasError::Infra); a 200 whose body carries no authenticationSuccess/user is CAS refusing the ticket (CasError::Denied).

extract_ticket 🔒

Reads the CAS ticket from the request’s query parameters.

extract_xml_tag 🔒

Returns the trimmed text between the first <tag> and its </tag>.

parse_service_validate 🔒

Extracts the authenticated username from a CAS /serviceValidate response.

percent_encode 🔒

Percent-encodes a query-argument value (RFC3986 unreserved chars kept).

session_cookie_str 🔒

Reads a string field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_cookie_u64 🔒

Reads a u64 field from nested session.cookie.<key>, falling back to the flat session_cookie_<key> form (used by the UI schema).

session_secret 🔒

Reads the session secret from session_secret or nested session.secret.