I don't know for sure, but looking at SurrogateAuthenticationConfiguration and the properties documentation it looks like you need to specify the ldap configuration specifically for the surrogate lookup eg cas.authn.*surrogate* .ldap.ldapUrl.
On 11 July 2017 at 23:45, Jozef Kotlar - EEA.sk <[email protected]> wrote: > Hello, > > I am investigating surrogate mechanism introduced in 5.1.0. > I seems that with static authentication this mechanism works as expected, > but when LDAP authentication is turned on, the > SurrogateAuthenticationAspect is not inspecting the authentication properly > (is not called anymore). > > Log from static authentication > > [org.apereo.cas.authentication.RegisteredServiceAuthenticationHandlerResolver] > - <Authentication handlers used for this transaction are [ > HttpBasedServiceCredentialsAuthenticationHandlerAcceptUsersA > uthenticationHandler]> > [org.apereo.cas.authentication.handler.support. > AbstractUsernamePasswordAuthenticationHandler] - <Transforming credential > username via [org.apereo.cas.configuration.support.Beans$$Lambda$72/ > 703476267]> > [org.apereo.cas.authentication.handler.support. > AbstractUsernamePasswordAuthenticationHandler] - <Attempting to encode > credential password via > [org.springframework.security.crypto.password.NoOpPasswordEncoder] > for [casuser]> > [org.apereo.cas.authentication.handler.support. > AbstractUsernamePasswordAuthenticationHandler] - <Attempting > authentication internally for transformed credential [casuser]> > [org.apereo.cas.authentication.*SurrogateAuthenticationAspect*] - > <Authenticated [casuser] will be checked for surrogate eligibility next...> > [org.apereo.cas.authentication.AbstractAuthenticationManager] - > <Authentication handler [AcceptUsersAuthenticationHandler] successfully > authenticated [[surrogateUsername=otheruser]]> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Attempting to resolve a principal...> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Creating principal for [otheruser]> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Retrieved [2] attribute(s) from the > repository> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Found attribute [uid]> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Found attribute [commonName]> > [org.apereo.cas.authentication.AbstractAuthenticationManager] - > <[org.apereo.cas.authentication.SurrogatePrincipalResolver@4951c83f[ > returnNullIfNoAttributes=false,principalAttributeName=<null>]] resolved > [otheruser] from [[surrogateUsername=otheruser]]> > [org.apereo.cas.authentication.AbstractAuthenticationManager] - <Final > principal resolved for this authentication event is [otheruser]> > > > Log from LDAP authentication > > [org.apereo.cas.authentication.RegisteredServiceAuthenticationHandlerResolver] > - <Authentication handlers used for this transaction are [ > LdapAuthenticationHandlerHttpBasedServiceCredentialsAuthenti > cationHandler]> > [org.apereo.cas.authentication.handler.support. > AbstractUsernamePasswordAuthenticationHandler] - <Transforming credential > username via [org.apereo.cas.configuration.support.Beans$$Lambda$69/ > 593438230]> > [org.apereo.cas.authentication.handler.support. > AbstractUsernamePasswordAuthenticationHandler] - <Attempting to encode > credential password via > [org.springframework.security.crypto.password.NoOpPasswordEncoder] > for [casuser]> > [org.apereo.cas.authentication.handler.support. > AbstractUsernamePasswordAuthenticationHandler] - <Attempting > authentication internally for transformed credential [casuser]> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <Attempting > LDAP authentication for [casuser]. Authenticator pre-configured attributes > are [null], additional requested attributes for this authentication request > are [[]]> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <LDAP > response: [[org.ldaptive.auth.AuthenticationResponse@560783821:: > authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, > resolvedDn=uid=casuser,ou=Users,dc=localdomain, > ldapEntry=[dn=uid=casuser,ou=Users,dc=localdomain[[uid[casuser]], [sn[CAS > User]], [cn[CAS User]], [objectClass[top, inetOrgPerson, > organizationalPerson, person]], [userPassword[ > e1NTSEF9YjdhTHpLMEhHM2crT0pKWEZOVFJHL3hIQUkxbGRBK1Y=]]], > responseControls=null, messageId=-1], accountState=null, result=true, > resultCode=SUCCESS, message=null, controls=null]]> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <Applying > password policy to [[org.ldaptive.auth.AuthenticationResponse@560783821:: > authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, > resolvedDn=uid=casuser,ou=Users,dc=localdomain, > ldapEntry=[dn=uid=casuser,ou=Users,dc=localdomain[[uid[casuser]], [sn[CAS > User]], [cn[CAS User]], [objectClass[top, inetOrgPerson, > organizationalPerson, person]], [userPassword[ > e1NTSEF9YjdhTHpLMEhHM2crT0pKWEZOVFJHL3hIQUkxbGRBK1Y=]]], > responseControls=null, messageId=-1], accountState=null, result=true, > resultCode=SUCCESS, message=null, controls=null]]> > [org.apereo.cas.authentication.support.DefaultAccountStateHandler] - > <Account state not defined. Returning empty list of messages.> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <LDAP > response returned a result. Creating the final LDAP principal> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <Creating > LDAP principal for [casuser] based on [uid=casuser,ou=Users,dc=localdomain] > and attributes [[uid, sn, cn, objectClass, userPassword]]> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <Principal id > attribute is not defined. Using the default provided user id [casuser]> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <Recording > principal DN attribute as [LdapAuthenticationHandler.casuser]> > [org.apereo.cas.authentication.LdapAuthenticationHandler] - <Created LDAP > principal for id [casuser] and [1] attributes> > [org.apereo.cas.authentication.AbstractAuthenticationManager] - > <Authentication handler [LdapAuthenticationHandler] successfully > authenticated [[surrogateUsername=otheruser]]> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Invoking principal resolver [org.apereo.cas.authentication. > SurrogatePrincipalResolver@5049b609[returnNullIfNoAttributes= > false,principalAttributeName=<null>]]> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Attempting to resolve a principal...> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Creating principal for [casuser]> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Retrieved [2] attribute(s) from the > repository> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Found attribute [uid]> > [org.apereo.cas.authentication.principal.resolvers. > PersonDirectoryPrincipalResolver] - <Found attribute [commonName]> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Invoking principal resolver [org.apereo.cas.authentication.principal. > resolvers.EchoingPrincipalResolver@25924f08[]]> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Resolved principal [casuser]> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Adding attributes [{commonName=CAS User, uid=casuser}] for the final > principal> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Resolved principal [casuser]> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Adding attributes [{LdapAuthenticationHandler. > casuser=uid=casuser,ou=Users,dc=localdomain}] for the final principal> > [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] > - <Final principal constructed by the chain of resolvers is [casuser]> > > > Used configuration is following > > > cas.authn.accept.users= > > cas.authn.ldap[0].type=AUTHENTICATED > cas.authn.ldap[0].ldapUrl=ldap://192.168.210.33:389 > cas.authn.ldap[0].useSsl=false > cas.authn.ldap[0].baseDn=dc=localdomain > cas.authn.ldap[0].userFilter=uid={user} > cas.authn.ldap[0].subtreeSearch=true > cas.authn.ldap[0].bindDn=cn=admin,dc=localdomain > cas.authn.ldap[0].bindCredential=secret > > cas.authn.attributeRepository.ldap[0].attributes.uid=uid > cas.authn.attributeRepository.ldap[0].attributes.displayName=displayName > cas.authn.attributeRepository.ldap[0].attributes.cn=commonName > cas.authn.attributeRepository.ldap[0].attributes. > affiliation=groupMembership > > cas.authn.attributeRepository.ldap[0].ldapUrl=ldap://192.168.210.33:389 > cas.authn.attributeRepository.ldap[0].useSsl=false > cas.authn.attributeRepository.ldap[0].baseDn=dc=localdomain > cas.authn.attributeRepository.ldap[0].userFilter=uid={user} > cas.authn.attributeRepository.ldap[0].subtreeSearch=true > cas.authn.attributeRepository.ldap[0].bindDn=cn=admin,dc=localdomain > cas.authn.attributeRepository.ldap[0].bindCredential=secret > > cas.authn.surrogate.simple.surrogates.casuser=otheruser > > > Am I missing something? > > Thanks, > Jozef > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: https://apereo.github.io/cas/ > Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit https://groups.google.com/a/ > apereo.org/d/msgid/cas-user/91ae56c6-25e0-430a-afee- > 4bcf962f3b3a%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/91ae56c6-25e0-430a-afee-4bcf962f3b3a%40apereo.org?utm_medium=email&utm_source=footer> > . > -- This email is sent on behalf of Northgate Public Services (UK) Limited and its associated companies including Rave Technologies (India) Pvt Limited (together "Northgate Public Services") and is strictly confidential and intended solely for the addressee(s). If you are not the intended recipient of this email you must: (i) not disclose, copy or distribute its contents to any other person nor use its contents in any way or you may be acting unlawfully; (ii) contact Northgate Public Services immediately on +44(0)1908 264500 quoting the name of the sender and the addressee then delete it from your system. Northgate Public Services has taken reasonable precautions to ensure that no viruses are contained in this email, but does not accept any responsibility once this email has been transmitted. You should scan attachments (if any) for viruses. Northgate Public Services (UK) Limited, registered in England and Wales under number 00968498 with a registered address of Peoplebuilding 2, Peoplebuilding Estate, Maylands Avenue, Hemel Hempstead, Hertfordshire, HP2 4NN. Rave Technologies (India) Pvt Limited, registered in India under number 117068 with a registered address of 2nd Floor, Ballard House, Adi Marzban Marg, Ballard Estate, Mumbai, Maharashtra, India, 400001. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAD0p8puQT13nDDK%2BCFu%3D0QO%2BCc_o2DH219NEtyW069oFgj6P-Q%40mail.gmail.com.
