TGT expiration policy based on request IP

[mmoayyed]

Explore the possibility of defining a composite expiration policy that acts based on the user's IP address and can delegate to inner policies based on configurable pattern/rule

[dima767]

Now we could revisit this for potential inclusion in 1.9. Once again, what would it look like? :-)

[mmoayyed]

So, I am thinking that the delegator and the evalator need to be separate and pluggable. As in:

1. There is a ticket expiration policy that is able to delegate the work to other expiration policy components.
2. There is an evaluator API, pluggable that return perhaps a true/false. Helps the delegator understand whether the request needs to be routed to inner expiration policy one (if true), or two (if false)

We would then write various impls of the evaluator, one that is IP-based maybe.

[mmoayyed]

So for instance, the use case might be that if the evaluator (that is IP-based) matches a particular pattern out of the http request object, (one that perhaps indicates a public workstation) the evaluator returns true. Then, the delegator would base that request of a plugged in ticket expirationly policy that says, expire tickets immediately.

The evalutor needs to be pluggable with various impls. The inner delegated-to ticket expiration policies also need to be pluggable and wired in.

[mmoayyed]

https://github.com/Unicon/cas-addons/wiki/Request-Based-Ticket-Expiration-Policy