Hi, The secret is expected to be sent as a GET / POST request parameter so that's why it fails. The OAuth protocol is a bit fuzzy on these points.
We could improve that in the next CAS release (4.3): could you open a Github issue for that? Thanks. Best regards, Jérôme 2016-01-22 22:55 GMT+01:00 Steve Selaya <[email protected]>: > I did a packet capture to see what the client app was sending to CAS and > it appears that the secret is being sent over as a Basic Authorization > under Credentials. I assume then that the app is sending the secret over > in the correct format? > > POST /cas/oauth2.0/accessToken HTTP/1.1\r\n > Authorization: Basic a2V5OkZyYW5r\r\n > Credentials: key:SuperSecretPassword > > Content-Length: 162 > Content-Type: application/x-www-form-urlencoded; charset=UTF-8 > Host: cas-test.bogus-domain.edu > Connection: Keep-Alive > User-Agent: SSOUTH v5.3.1.1 b117 r38654 > > HTML Form URL Encoded: application/x-www-form-urlencoded > Form item: "code" = "ST-27-yuMklCmWApBWGSQ9NqQQ-cas-test" > key: code > Value: ST-27-yuMklCmWApBWGSQ9NqQQ-cas-test > Form item: "grant_type" = "authorization_code" > key: grant_type > Value: authorization_code > Form item: "redirect_uri" = " > https://client-t.bogus-domain.edu:8443/bogusapp/public/oauth"; > key: redirect_uri > Value: https://client-t.bogus-domain.edu:8443/bogusapp/public/oauth > Form item: "client_id" = "supersecretkey" > key: client_id > Value: supersecretkey > > On Friday, January 22, 2016 at 9:58:26 AM UTC-6, leleuj wrote: >> >> Hi, >> >> The OAuth support in CAS 3.5.2 was a first version and now, key and >> secret go into the key and secret properties and the "annoying" screen can >> be bypassed. >> >> The DEBUG logs shows that you don't provide the secret when calling the >> access token endpoint ( >> https://github.com/Jasig/cas/blob/3.5.x/cas-server-support-oauth/src/main/java/org/jasig/cas/support/oauth/web/OAuth20AccessTokenController.java#L71), >> this is mandatory to respect the OAuth 2 protocol. Thus the error. >> >> Thanks. >> Best regards, >> Jérôme >> >> >> 2016-01-22 16:46 GMT+01:00 Steve Selaya <[email protected]>: >> >>> We are running CAS 3.5.2 and have gone through the configuration using >>> https://wiki.jasig.org/display/CASUM/Configuration+for+the+OAuth+server+support >>> to setup OAuth server support. From what we can tell, we have followed the >>> instructions correctly on both the CAS server and client application side >>> setting the key in the "name" field and the secret in the "description" >>> field on the CAS side. We get as far as logging into CAS and the >>> annoying "Do you want to grant access to your complete profile" page. Once >>> we click on the link to grant the access we get a 400 error on the client >>> side and the following appears in the CAS log (I have change the redirect >>> uri below so that it does not show the real client uri). Any help on this >>> would be appreciated. >>> >>> 2016-01-22 07:48:17,604 DEBUG >>> [org.jasig.cas.support.oauth.web.BaseOAuthWrapperController] - method : >>> accessToken >>> 2016-01-22 07:48:17,605 DEBUG >>> [org.jasig.cas.support.oauth.web.OAuth20AccessTokenController] - >>> redirect_uri : >>> https://client-t.bogus-domain.edu:8443/bogusapp/public/oauth >>> <https://www.google.com/url?q=https%3A%2F%2Fclient-t.bogus-domain.edu%3A8443%2Fbogusapp%2Fpublic%2Foauth&sa=D&sntz=1&usg=AFQjCNG1-hSpX828HTbF7EzVnsDLoCxKIw> >>> 2016-01-22 07:48:17,605 DEBUG >>> [org.jasig.cas.support.oauth.web.OAuth20AccessTokenController] - clientId : >>> supersecretkey >>> 2016-01-22 07:48:17,606 DEBUG >>> [org.jasig.cas.support.oauth.web.OAuth20AccessTokenController] - >>> clientSecret : null >>> 2016-01-22 07:48:17,606 DEBUG >>> [org.jasig.cas.support.oauth.web.OAuth20AccessTokenController] - code : null >>> 2016-01-22 07:48:17,606 ERROR >>> [org.jasig.cas.support.oauth.web.OAuth20AccessTokenController] - missing >>> clientSecret >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "CAS Community" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> Visit this group at >>> https://groups.google.com/a/apereo.org/group/cas-user/. >>> >> >> -- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/ > . > -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
