CAS Lockdown (Level 2) Sanctions
Browser redirection after a user has logged into CAS
- A CAS lockdown or level 2 sanction is a type of role-based access control ("RBAC") in which users with a specific user attribute (the forbidden attribute) have their web browsers redirected to an alternate or redirection URL instead of to their intended destination.
- This type of sanction is generally employed to persuade users to perform some required activity like taking a legally-mandated training course. Once the course has been completed, the forbidden attribute is removed and access is restored.
- Each CAS level 2 sanction has an order number, a forbidden attribute, and a URL.
- In our environment, the forbidden attribute is an LDAP affiliation.
- CAS can be configured with multiple level 2 sanctions, each with its own redirection URL. For example:
- Order
- 1
- Affiliation
- needs_course_a
- Redirection URL
- https://www.columbia.edu/course_a
- Order
- 2
- Affiliation
- needs_course_b
- Redirection URL
- https://www.columbia.edu/course_b
- Order
- 3
- Affiliation
- needs_course_c
- Redirection URL
- https://www.columbia.edu/course_c
To Create a new CAS Level 2 sanction: create a ServiceNow request describing the desired sanction and assign it to the Identity and Access Management Group (IAM). We'll get in touch to discuss next steps.
Notes:
- If a user has more than 1 forbidden affiliation and as a result is subject to more than one level 2 sanction, the redirection is applied in numerical order. In the example above, (1) needs_course_a would be applied in preference to (2) needs_course_b when a user had both affiliations.
- The redirection URL should point to a webpage that provides information and links that help users satisfy the requirement.
- Browser redirection of this kind is disruptive and can be disturbing to users. It should be used sparingly.
- Access to the myColumbia portal, HR-related services like PAC and Benefits Enrollment, as well as ELM training and UNI maintenance, is exempted from the CAS level 2 sanction redirection lockdown.