Hello Community,
i've already described the problem in short here <https://github.com/apereo/cas/issues/2711>, i would propose the modification. Because i'm newbie in CAS usage and development i need an expertise about this proposal. *What is done now* 1. Running CAS 5.1.0 Server configured via gradle overlay for delegating the authentication to Azure AD OIDC provider 2. Necessary parameter for OIDC delegation configured as described in a manual 3. App is properly registered by Azure, secret, client_id, tenant are known and operational *Problem description* Open ID Connect delegation doesn't work as expected. 1. client_name URL parameter is appended to the redirect_uri. this is not allowed by Azure AD OIDC anymore and is simply ignored (not given back by redirect). The only accepted parameter that will be replied to caller is state. 2. client_name URL parameter is appended to the service url for validating the token. This is also not allowed by Azure AD OIDC as the url must be exact one of the configured by Azure. *Proposal* Resolution for the 1. and 2. is to remove the client_name parameter form the callback url done for example via call to AzureAdClient.setIncludeClientNameInCallbackUrl(*false*); within the constructor of AzureAdClient. This improvement works well excepting the circumstance, that the CAS server stoped to forward the callback redirects to the correct client. I assume, this occurs because of missing of client_name parameter. If i append the client_name=AzureADClient1 via url rewriting, the request is processed well, validation succeeds and the application (in my case it was CAS Management Webapp) is happy to login me. My proposal is to define a context path named "oidc" (or more convinient?) followed by the client_name for the callback url (eg. /oidc/AzureADClient1 etc. ). The filter for "/oidc/*" could than route the requests correctly to the right handler. More goodies: It could be helpful to provide optional attributes for display label and description within the client configuration to customize client button/link. If somebody has multiple realms/apps by the same provider, all of client buttons are labeled with the same "AzureAd", what is a little bit confusing. I need help with some CAS implementation details: 1. how does the request routing implemented within the CAS 2. how one can define an additional context path for a service/delegate configuration I don’t need a deep details, any hint or link to relevant docu are welcome! I hope, you can understand my objective. If you have any ideas/improvements, they are very appreciated! Kind regards, Gena -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d1216301-e547-4e4c-ae74-94adbccd6286%40apereo.org.
