Cas group allow

social_core/backends/cas.py

@@ -25,6 +25,7 @@ class CASOpenIdConnectAuth(OpenIdConnectAuth):
     SOCIAL_AUTH_CAS_OIDC_ENDPOINT = 'https://.....'  # endpoint without /.well-known/openid-configuration
     SOCIAL_AUTH_CAS_KEY = '<client_id>'
     SOCIAL_AUTH_CAS_SECRET = '<client_secret>'
+    SOCIAL_AUTH_CAS_ALLOW_GROUPS = []
     """
 
     name = "cas"
@@ -59,3 +60,12 @@ def get_user_details(self, response):
             "first_name": attributes.get("given_name"),
             "last_name": attributes.get("family_name"),
         }
+
+    def auth_allowed(self, response, details):
+        allow_groups = set(self.setting("ALLOW_GROUPS", set()))
+        groups = set(response.get("groups", set()))
+        return (
+            super().auth_allowed(response, details)
+            if groups.intersection(allow_groups) or not allow_groups
+            else False
+        )

social_core/tests/backends/test_cas.py

@@ -47,6 +47,12 @@ def extra_settings(self):
         settings.update(
             {
                 f"SOCIAL_AUTH_{self.name}_OIDC_ENDPOINT": f"{ROOT_URL}oidc",
+                f"SOCIAL_AUTH_{self.name}_ALLOW_GROUPS": [
+                    "users",
+                ],
+                f"SOCIAL_AUTH_{self.name}_WHITELISTED_DOMAINS": [
+                    "example.net",
+                ],
             }
         )
         return settings