Answering with the workaround I used. It is far from ideal, but works. It relies on having access to the DB of the client site. This uses D7 rules with the php-filter module. It would be much more elegant in it's own custom module.
The site sending the POST request uses sql to update the authname table on the site receiving the POST request. The created user then has a cas-username.
Below is the code for the rule action - creates the POST request, then alters the DB.
// Generate random password
$bytes = random_bytes(10);
$pass = bin2hex($bytes);
// data for user fields
$data = array(
'name' => array(
'value' => '[account:name]'
),
'mail' => array(
'value' => '[account:mail]'
),
'status' => array(
'value' => 1
),
'pass' => array(
'value' => $pass
)
);
// POST code
$data_string = json_encode($data);
// POST with cURL
$url = 'https://example.com/restendpoint';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_USERPWD, "username:password");
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$response = curl_exec($ch);
// Get UID from response
$newuser = json_decode($response, true);
$newuseruid = $newuser['uid'][0]['value'];
// DB update
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "dbname";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sql = "INSERT INTO authmap (uid, provider, authname, data)
VALUES ($newuseruid, 'cas', '[account:name]', 'N;')";
if ($conn->query($sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
}
$conn->close();
curl_close($ch);