We (http://ala.org.au) have been using similar setup to what you are trying to achieve https://github.com/AtlasOfLivingAustralia/ala-cas-2.0; it should be rather trivial to modify/adjust that to what you need.
The difference is in that we are not using LDAP (but you already have the LDAP part working). Our setup is as follows: We have 2 diff authenticators https://github.com/AtlasOfLivingAustralia/ala-cas-2.0/blob/master/src/main/webapp/WEB-INF/deployerConfigContext.xml#L64-L65 - primaryAuthenticationHandler that does a username/password auth against mysql - secondaryAuthenticationHandler that does auth against OAuth1.0, OAuth2.0 (Facebook/Google/Twitter plus i tested successfully LinkedIn/GitHub/WindozeLive too) this one is used for a "one click" SignUp/SignIn via Facebook/Google/Twitter So you do already have a working LDAP auth (similar to our mysql backed primaryAuthenticationHandler): - primaryAuthenticationHandler is associated with primaryPrincipalResolver ( https://github.com/AtlasOfLivingAustralia/ala-cas-2.0/blob/master/src/main/webapp/WEB-INF/deployerConfigContext.xml#L64 ) - primaryPrincipalResolver in turn has a property attributeRepository ( https://github.com/AtlasOfLivingAustralia/ala-cas-2.0/blob/master/src/main/webapp/WEB-INF/deployerConfigContext.xml#L174 ) - and finally the attributeRepository uses SQL query to retrieve your custom attributes from a DB (again mysql in our case) https://github.com/AtlasOfLivingAustralia/ala-cas-2.0/blob/master/src/main/webapp/WEB-INF/deployerConfigContext.xml#L194 - the custom attributes have to be listed in allowedAttributes property under the registeredServicesList ( https://github.com/AtlasOfLivingAustralia/ala-cas-2.0/blob/master/src/main/webapp/WEB-INF/deployerConfigContext.xml#L224-L230 ) i hope that might help, perhaps, cheers, On Wednesday, September 14, 2016 at 11:17:21 PM UTC+10, Toni McWild wrote: > > Hi guys, > I have deployed 4.2 CAS server for my company but now we are facing a > problem.... > > Our principal Handler is an LDAP, but the way our LDAP server is > implemented doesn't allow to store every group that a specific user belongs > to, > > I mean, for user "toni" I can login, I can get the main group that "toni" > belongs to, but our LDAP doesn't have a field similar to > "GroupsAUserBelongsTo" > Our LDAP works the other way arround, for group "Management" there is a > list of users that belong to this groups. > > Anyway, I've got a MySQL DDBB that I can ask to get the groups a user > belongs to. > > so my question is: > > Is there any way I can merge both systems? LDAP authentication but right > after the authentication it goes to MySQL and ask for the groups that a > user belongs to. > > Thanks a lot! > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/deb5d7db-8361-48fd-ac47-442ae0b5be4d%40apereo.org.
