We currently have a few web services behind LDAP auth which deploy an Icinga check whether the endpoint is protected by LDAP (implemented via the check_https_unauthorized Icinga check which checks for a 401 response).

We should create a similar Icinga check CAS-projected end points, it could e.g. that accessing the protected endpoint triggers an 301 TLS redirect to the IDP login page.

This could be added via a dedicated profile (which in turn could be added to profile::idp::client::http, so that the check is added by default).