Customize the internal callbackAuthorize service

* Re-use oldCAS service ID which is fixed instead of random
* Use a new user-friendly service name that  informs users that
  this is the login to authorize
* Temporarily disabled the to-be-implemented ORCiD login for OAuth
  via access strategy due to an oldCAS limitation, which has been
  removed in newCAS
* Return allowed attributes via release strategy

Author: cslzchen

src/main/java/org/apereo/cas/config/CasOAuth20ServicesConfiguration.java

@@ -3,11 +3,12 @@
 import org.apereo.cas.authentication.principal.Service;
 import org.apereo.cas.authentication.principal.ServiceFactory;
 import org.apereo.cas.configuration.CasConfigurationProperties;
-import org.apereo.cas.services.DenyAllAttributeReleasePolicy;
+import org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy;
+import org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy;
 import org.apereo.cas.services.RegexRegisteredService;
+import org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy;
 import org.apereo.cas.services.ServiceRegistryExecutionPlanConfigurer;
 import org.apereo.cas.support.oauth.services.OAuth20ServiceRegistry;
-import org.apereo.cas.util.RandomUtils;
 
 import lombok.val;
 
@@ -23,6 +24,9 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.Ordered;
 
+import java.util.ArrayList;
+import java.util.List;
+
 /**
  * This is {@link CasOAuth20ServicesConfiguration}.
  *
@@ -56,14 +60,28 @@ public Service oauthCallbackService() {
     @Bean
     @ConditionalOnMissingBean(name = "oauthServiceRegistryExecutionPlanConfigurer")
     public ServiceRegistryExecutionPlanConfigurer oauthServiceRegistryExecutionPlanConfigurer() {
+
+        // TODO: Currently, "login to authorize" is not supported for ORCiD, thus only add institution clients. Fortunately, unlike
+        //       oldCAS, newCAS supports this feature to be implemented using JPA OSF data access model without OSF side changes.
+        final List<String> allowedProviders = new ArrayList<>(casProperties.getAuthn().getOsfPostgres().getInstitutionClients());
+        final DefaultRegisteredServiceDelegatedAuthenticationPolicy delegatedAuthenticationPolicy = new DefaultRegisteredServiceDelegatedAuthenticationPolicy();
+        delegatedAuthenticationPolicy.setAllowedProviders(allowedProviders);
+        delegatedAuthenticationPolicy.setPermitUndefined(false);
+        final DefaultRegisteredServiceAccessStrategy accessStrategy = new DefaultRegisteredServiceAccessStrategy();
+        accessStrategy.setDelegatedAuthenticationPolicy(delegatedAuthenticationPolicy);
+
+        // OSF CAS customization: re-use oldCAS service ID which is fixed instead of random, use a new user-friendly service name that
+        // informs users that this is the login to authorize, temporarily disable ORCiD login via access strategy due to the aforementioned
+        // oldCAS limitation, and return allowed attributes via release strategy
         return plan -> {
             val service = new RegexRegisteredService();
-            service.setId(RandomUtils.nextLong());
+            service.setId(983450982340993434L);
             service.setEvaluationOrder(Ordered.HIGHEST_PRECEDENCE);
-            service.setName(service.getClass().getSimpleName());
+            service.setName("OSF Authorization");
             service.setDescription("OAuth Authentication Callback Request URL");
             service.setServiceId(oauthCallbackService().getId());
-            service.setAttributeReleasePolicy(new DenyAllAttributeReleasePolicy());
+            service.setAccessStrategy(accessStrategy);
+            service.setAttributeReleasePolicy(new ReturnAllowedAttributeReleasePolicy(new ArrayList<>()));
             plan.registerServiceRegistry(new OAuth20ServiceRegistry(applicationContext, service));
         };
     }