I just got past the problem by changing the attribute release policy to:
"attributeReleasePolicy" :
{
"@class" : "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
"allowedAttributes" : [ "java.util.ArrayList", [ "cn", "mail", "sn",
"uid", "givenName" ] ]
}
The previous value was:
"attributeReleasePolicy" :
{
"@class" : "org.apereo.cas.services.ReturnAllAttributeReleasePolicy"
}
Maybe that's a defect if the default XML is invalid when including all
attributes?
BTW - I am still looking for advice or best practices for validating using
email and/or username when using LDAP.
Thanks again!
Abre Chase
On Monday, July 24, 2017 at 3:41:20 PM UTC-4, Abre Chase wrote:
>
> I have a requirement to allow a user to sign in with either their username
> or email address. I was thinking I could set this up by declaring multiple
> ldap sources or maybe an or userFilter.
>
> However, when I test just using the email address I can get past the
> initial CAS login but the client fails to parse the response.
>
> The CAS configuration looks something like this:
>
> cas.authn.ldap[0].type=AUTHENTICATED
> cas.authn.ldap[0].ldapUrl=ldap://localhost:10389
> cas.authn.ldap[0].useSsl=false
> cas.authn.ldap[0].baseDn=ou=people,dc=myorg
> cas.authn.ldap[0].userFilter=mail={user}
> cas.authn.ldap[0].subtreeSearch=true
> cas.authn.ldap[0].bindDn=uid=admin,ou=system
> cas.authn.ldap[0].bindCredential=xxxx
> cas.authn.ldap[0].principalAttributeId=uid
> cas.authn.ldap[0].principalAttributePassword=
>
> The response looks this:
>
> <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
> <cas:authenticationSuccess>
> <cas:user>test</cas:user>
> <cas:attributes>
> <cas:[email protected]
> >cn=test,ou=people,dc=myorg</cas:[email protected]>
> <cas:isFromNewLogin>true</cas:isFromNewLogin>
>
> <cas:authenticationDate>2017-07-24T15:15:47.846-04:00[America/New_York]</cas:authenticationDate>
>
> <cas:authenticationMethod>LdapAuthenticationHandler</cas:authenticationMethod>
>
> <cas:successfulAuthenticationHandlers>LdapAuthenticationHandler</cas:successfulAuthenticationHandlers>
>
> <cas:longTermAuthenticationRequestTokenUsed>false</cas:longTermAuthenticationRequestTokenUsed>
> </cas:attributes>
> </cas:authenticationSuccess>
> </cas:serviceResponse>
>
> The client code XML parser is unable to get past the <
> cas:[email protected]> element.
>
> Any suggestions about how I should be validating against email address?
> Am I missing some mapping so the email address doesn't end up in the XML
> element name?
>
> Thanks!
>
> Abre Chase
>
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/a88a9bff-bfc7-41f0-9d4e-33d12e11862d%40apereo.org.
