Struct CasAuthPlugin 

pub struct CasAuthPlugin {
    idp_uri: String,
    service: Option<String>,
    ticket_param: String,
    ssl_verify: bool,
    timeout: Duration,
    sealer: Option<CookieSealer>,
    cookie_name: String,
    cookie_path: String,
    cookie_lifetime: u64,
    logout_path: Option<String>,
    client: Arc<OutboundClient>,
}

Validates CAS service tickets and, in interactive mode, runs the SSO flow.

Fields

idp_uri: String

CAS server base URI (e.g. https://cas.example.org/cas).

service: Option<String>

Service URL sent to /serviceValidate; when unset it is derived from the request (scheme://host/path). Must match the service the ticket was issued for, so an explicit value is strongly recommended.

ticket_param: String

Query parameter the ticket is read from (default ticket).

ssl_verify: bool

Whether the CAS server’s TLS certificate is verified.

timeout: Duration

Whole-call deadline for the validation callout.

sealer: Option<CookieSealer>

When set, interactive SSO login is enabled and this seals/opens the session cookie. None keeps the stateless ticket-validator behavior.

cookie_name: String

Name of the session cookie (interactive mode).

cookie_path: String

Path attribute of the session cookie (interactive mode). Scope it to a subpath (e.g. /app_a) so nodes on distinct subpaths keep independent sessions. Defaults to /.

cookie_lifetime: u64

Session cookie lifetime in seconds (interactive mode).

logout_path: Option<String>

Optional logout path; a request to it clears the session cookie.

client: Arc<OutboundClient>

Implementations

impl CasAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• idp_uri (string, required): CAS server base URI. The validation request goes to <idp_uri>/serviceValidate.
• service (string, optional): service URL passed to /serviceValidate. When omitted it is derived from the request scheme/host/path; because CAS requires the validated service to match the login service, set this explicitly whenever the gateway sits behind a proxy.
• ticket_param (string, default "ticket"): query parameter carrying the CAS service ticket.
• ssl_verify (bool, default true): verify the CAS server TLS cert.
• timeout_ms (u64, default 3000): callout deadline.

Interactive-mode keys (present ⇒ interactive login is enabled):

• session_secret (string) or session.secret (string): signing/encryption secret for the session cookie. Setting it turns on the SSO flow.
• session.cookie.name (string, default "cas_session"): session cookie name.
• session.cookie.path (string, default "/"): session cookie Path; scope to a subpath (e.g. /app_a) for independent per-app sessions.
• session.cookie.lifetime (u64 seconds, default 3600): cookie lifetime.
• logout_path (string, optional): request path that clears the session cookie and redirects to /.

type: cas-auth
config:
  idp_uri: https://cas.example.org/cas
  service: https://app.example.org/
  ssl_verify: true
  session:
    secret: ${CAS_SESSION_SECRET}
    cookie: { name: cas_session, lifetime: 3600 }

fn reject( &self, ctx: Context, message: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds a 401 rejection routed through the node’s error port.

fn redirect( &self, ctx: Context, location: String, set_cookies: Vec<String>, ) -> Result<PluginOutput, PluginExecutionError>

Builds a 302 early-exit carrying the prepared response. Wire the node’s error edge to client.in so this reaches the browser.

fn service_url(&self, ctx: &Context) -> String

The service URL sent to /serviceValidate: the configured value, or one derived from the request (scheme://host/path, without the query so the ticket is dropped).

fn session_attrs(&self, ctx: &Context) -> CookieAttrs<'_>

Cookie attributes for the session cookie: HttpOnly, SameSite=Lax, and Secure only over HTTPS (so plain-HTTP dev works).

fn attach_user(&self, ctx: &mut Context, user: &str)

Attaches the authenticated user to the request/context.

fn read_session(&self, ctx: &Context) -> Option<String>

Reads and opens the session cookie, returning the authenticated user.

async fn cas_validate( &self, ctx: &Context, ticket: &str, ) -> Result<String, String>

Validates a CAS ticket against /serviceValidate, returning the user.

async fn execute_interactive( &self, ctx: Context, ) -> Result<PluginOutput, PluginExecutionError>

Interactive SSO flow: session cookie → callback → begin login.

async fn execute_stateless( &self, ctx: Context, ) -> Result<PluginOutput, PluginExecutionError>

Stateless ticket validation (the default, pre-interactive behavior).

Trait Implementations

impl Plugin for CasAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.