Casdoor IAM Auth Engine and OIDC Discovery Sentinel

id: casdoor-iam-auth-engine-and-oidc-discovery-sentinel
namespace: company.security

description: "Continuously audits Casdoor open-source IAM authentication engine
  health, validates OpenID Connect discovery endpoints, and dispatches incident
  alerts on identity provider degradation."

inputs:
  - id: casdoor_host
    type: STRING
    defaults: "localhost"
    description: "Hostname or IP address of the Casdoor server instance."

  - id: casdoor_port
    type: INT
    defaults: 8000
    description: "HTTP port for Casdoor REST API and authentication web UI (default: 8000)."

  - id: slack_channel
    type: STRING
    defaults: "#security-alerts"
    description: "Target Slack channel for authentication outages and IAM
      degradation alerts."

triggers:
  - id: periodic_iam_audit
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true

tasks:
  - id: probe_casdoor_health
    type: io.kestra.plugin.core.http.Request
    description: "Queries Casdoor system health endpoint to verify application
      daemon responsiveness and database connection pool state."
    uri: "http://{{ inputs.casdoor_host }}:{{ inputs.casdoor_port }}/api/health"
    method: GET
    options:
      timeout:
        readIdleTimeout: PT15S

  - id: probe_oidc_discovery
    type: io.kestra.plugin.core.http.Request
    description: "Validates the standard OpenID Connect discovery endpoint to ensure
      authorization server metadata and signing key references remain
      accessible."
    uri: "http://{{ inputs.casdoor_host }}:{{ inputs.casdoor_port
      }}/.well-known/openid-configuration"
    method: GET
    options:
      timeout:
        readIdleTimeout: PT15S

  - id: classify_iam_state
    type: io.kestra.plugin.core.flow.Switch
    description: "Evaluates health status and OIDC discovery responses to classify
      Casdoor state into AUTH_ENGINE_OFFLINE, OIDC_DISCOVERY_DEGRADED, or
      HEALTHY."
    value: >-
      {% if outputs.probe_casdoor_health.code != 200 %}
        AUTH_ENGINE_OFFLINE
      {% elseif outputs.probe_oidc_discovery.code != 200 or
      outputs.probe_oidc_discovery.body.issuer is not defined %}
        OIDC_DISCOVERY_DEGRADED
      {% else %}
        HEALTHY
      {% endif %}
    cases:
      AUTH_ENGINE_OFFLINE:
        - id: alert_engine_offline
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Notifies security and platform on-call when the Casdoor
            authentication engine fails health probes."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "[CRITICAL] Casdoor IAM Authentication Engine Offline",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "[ALERT] Casdoor IAM Service Unavailable"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Target Host:*\n`{{ inputs.casdoor_host }}:{{ inputs.casdoor_port }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*HTTP Status:*\n`{{ outputs.probe_casdoor_health.code }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Execution ID:*\n`{{ execution.id }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Severity:*\n`CRITICAL`"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "Immediate action required: Check Casdoor container logs, database connectivity, and reverse proxy routing."
                    }
                  ]
                }
              ]
            }

        - id: fail_on_engine_offline
          type: io.kestra.plugin.core.execution.Fail
          description: "Fails the workflow execution to enforce SLA breach tracking."

      OIDC_DISCOVERY_DEGRADED:
        - id: alert_oidc_degraded
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches high-priority alert when OIDC discovery endpoint is
            broken, preventing single sign-on federations."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "[WARNING] Casdoor OIDC Discovery Metadata Corrupted or Incomplete",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "[WARNING] Casdoor OIDC Federation Degraded"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Host:*\n`{{ inputs.casdoor_host }}:{{ inputs.casdoor_port }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*OIDC Status Code:*\n`{{ outputs.probe_oidc_discovery.code }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Issue:*\n`Missing or Invalid Issuer in Metadata`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Severity:*\n`HIGH`"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "Action required: Inspect Casdoor domain certificate, public origin configuration, and JWKS endpoints."
                    }
                  ]
                }
              ]
            }

        - id: fail_on_oidc_degraded
          type: io.kestra.plugin.core.execution.Fail
          description: "Fails the execution to halt downstream dependent workflows."

      HEALTHY:
        - id: log_iam_healthy
          type: io.kestra.plugin.core.log.Log
          description: "Logs verified health indicators when Casdoor authentication and
            OIDC endpoints are operating nominally."
          message: "[OK] Casdoor IAM at {{ inputs.casdoor_host }}:{{ inputs.casdoor_port
            }} is fully operational. Health endpoint returned HTTP {{
            outputs.probe_casdoor_health.code }} and OIDC issuer '{{
            outputs.probe_oidc_discovery.body.issuer ?? 'verified' }}' is
            active."

  - id: audit_sentinel_run
    type: io.kestra.plugin.core.log.Log
    description: "Final audit log recording execution ID, verified issuer, and IAM
      health status."
    message: "[AUDIT] Casdoor IAM sentinel completed execution {{ execution.id }}.
      Target server: {{ inputs.casdoor_host }}:{{ inputs.casdoor_port }}. OIDC
      issuer: {{ outputs.probe_oidc_discovery.body.issuer ?? 'N/A' }}."