Hi, It should work. The authentication delegation is handled by the ClientAction or DelegatedClientAuthenticationAction class (the name has changed over versions) which uses the ClientAuthenticationHandler. In this handler, the user profile attributes are used to build the SimplePrincipal: when you turn on the DEBUG logs on org.jasig/org.apereo, what do you see for the built principal? Thanks. Best regards, Jérôme
On Thu, Oct 26, 2017 at 6:28 AM, Edward <[email protected]> wrote: > Hi All, > Thank you very much for your response: > > 1. my scope for google is: > cas.authn.pac4j.google.scope=EMAIL_AND_PROFILE > > 2. after add logging.level.org.pac4j=DEBUG > i can see in the log that google return lot of attributes: > 2017-10-26 11:56:34,573 INFO > [org.pac4j.oauth.profile.creator.OAuth20ProfileCreator] > - <UserProfile: { > "kind": "plus#person", > "etag": "\"xxxxxxxxxx/xxxxxxxxxxxxxxxxx\"", > "emails": [ > { > "value": "[email protected]", > "type": "account" > } > ], > "objectType": "person", > "id": "15125125125125", > "displayName": "xxxxxx", > "name": { > "familyName": "XXXXX", > "givenName": "Xxxxxxx" > }, > "url": "https://plus.google.com/15125125125125";, > "image": { > "url": "https://lh4.googleusercontent.com/-XXXXXFxyqk/XXX/XXXXXXXcv/- > XXXasaXX/photo.jpg?sz=50", > "isDefault": false > }, > "isPlusUser": true, > "language": "en_GB", > "circledByCount": 6, > "verified": false > } > > > > but the final user profile JSON string i got is still the same, not the > full one like above. > { > "attributes": > { > "clientName": "Google" > }, > "id": "15125125125125" > } > > > 3. this is how i get CAS user profile : > HttpClient client = new HttpClient(); > tring profileUrl = "https://mydomain.dom.com:8443/cas/oauth2.0/profile? > access_token=AT-5-BXWqunDZXTVBZT6jSC6bjqfqodO7JStxJUf"; > GetMethod method = new GetMethod(profileUrl); > client.executeMethod(method); > resultStr = method.getResponseBodyAsString(); > //*resultStr* only contain above JSON string. > > 4. in the service configuration: > { > @class: org.apereo.cas.support.oauth.services.OAuthRegisteredService > serviceId: ^https://mydomain.dom.com:8443/cas-users-management/.* > name: CAS User Management > id: 1506918968305 > description: CAS user management > proxyPolicy: > { > @class: org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy > } > evaluationOrder: 0 > usernameAttributeProvider: > { > @class: org.apereo.cas.services.DefaultRegisteredServiceUserna > meProvider > canonicalizationMode: NONE > encryptUsername: false > } > attributeReleasePolicy: > { > @class: org.apereo.cas.services.*ReturnAllAttributeReleasePolicy* > principalAttributesRepository: > { > @class: org.apereo.cas.authentication.principal. > DefaultPrincipalAttributesRepository > expiration: 2 > timeUnit: HOURS > } > authorizedToReleaseCredentialPassword: false > authorizedToReleaseProxyGrantingTicket: false > excludeDefaultAttributes: false > } > > ...... > > i still cannot get the additional attributes from google. > Any suggestion? > > Thanks! > >> >> -- > - Website: https://apereo.github.io/cas > - Gitter Chatroom: https://gitter.im/apereo/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit https://groups.google.com/a/ > apereo.org/d/msgid/cas-user/6c9869dc-f7d4-42d7-9aba- > c846d2fb810c%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/6c9869dc-f7d4-42d7-9aba-c846d2fb810c%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAP279LyYT%2BgAuCFujTXZJx%3DP_eau8oX-s4BDg1HC%2BzO-p-ro%3Dg%40mail.gmail.com.
