Maybe that's a defect if the default XML is invalid when including all
attributes?
BTW - I am still looking for advice or best practices for validating
using email and/or username when using LDAP.
Not sure if best practice or not, but I have a similar requirement and
fulfill it by adjusting the user-filter:
cas.authn.ldap[0].userFilter=(|(sAMAccountName={user})(userPrincipalName={user}))
i.e. - do a filter that looks for sAMAccountname OR userPrincipalName
(in your case I'm guessing it'd be (|(uid={user})(mail={user})))
This is against ActiveDirectory w/ different requirements but the same
general principle should apply - haven't had any problems.
Matt
Thanks again!
Abre Chase
On Monday, July 24, 2017 at 3:41:20 PM UTC-4, Abre Chase wrote:
I have a requirement to allow a user to sign in with either their
username or email address. I was thinking I could set this up by
declaring multiple ldap sources or maybe an or userFilter.
However, when I test just using the email address I can get past the
initial CAS login but the client fails to parse the response.
The CAS configuration looks something like this:
cas.authn.ldap[0].type=AUTHENTICATED
cas.authn.ldap[0].ldapUrl=ldap://localhost:10389
cas.authn.ldap[0].useSsl=false
cas.authn.ldap[0].baseDn=ou=people,dc=myorg
cas.authn.ldap[0].userFilter=mail={user}
cas.authn.ldap[0].subtreeSearch=true
cas.authn.ldap[0].bindDn=uid=admin,ou=system
cas.authn.ldap[0].bindCredential=xxxx
cas.authn.ldap[0].principalAttributeId=uid
cas.authn.ldap[0].principalAttributePassword=
The response looks this:
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas
<http://www.yale.edu/tp/cas>'>
<cas:authenticationSuccess>
<cas:user>test</cas:user>
<cas:attributes>
<cas:[email protected]
<mailto:cas%[email protected]>>cn=test,ou=people,dc=myorg</cas:[email protected]
<mailto:cas%[email protected]>>
<cas:isFromNewLogin>true</cas:isFromNewLogin>
<cas:authenticationDate>2017-07-24T15:15:47.846-04:00[America/New_York]</cas:authenticationDate>
<cas:authenticationMethod>LdapAuthenticationHandler</cas:authenticationMethod>
<cas:successfulAuthenticationHandlers>LdapAuthenticationHandler</cas:successfulAuthenticationHandlers>
<cas:longTermAuthenticationRequestTokenUsed>false</cas:longTermAuthenticationRequestTokenUsed>
</cas:attributes>
</cas:authenticationSuccess>
</cas:serviceResponse>
The client code XML parser is unable to get past the
<cas:[email protected]
<mailto:cas%[email protected]>> element.
Any suggestions about how I should be validating against email
address? Am I missing some mapping so the email address doesn't end
up in the XML element name?
Thanks!
Abre Chase
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines:
https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google
Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to [email protected]
<mailto:[email protected]>.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/a88a9bff-bfc7-41f0-9d4e-33d12e11862d%40apereo.org
<https://groups.google.com/a/apereo.org/d/msgid/cas-user/a88a9bff-bfc7-41f0-9d4e-33d12e11862d%40apereo.org?utm_medium=email&utm_source=footer>.
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/9ee8482c-6f27-364c-fd40-36c5c615e96b%40fastmail.net.
