With the addition of those loggers and a little tweeking I got some info
that should be useful. Firstly:
2018-02-26 15:36:46,731 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Calling attribute policy [ReturnAllowedAttributeReleasePolicy] to process
attributes for [toben.archer]>
2018-02-26 15:36:46,731 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Attribute policy [ReturnAllowedAttributeReleasePolicy] allows release of
[{}] for [toben.archer]>
2018-02-26 15:36:46,732 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Attempting to merge policy attributes and default attributes>
2018-02-26 15:36:46,732 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Checking default attribute policy attributes>
2018-02-26 15:36:46,733 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Located application context. Retrieving default attributes for release, if
any>
2018-02-26 15:36:46,733 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Default attributes for release are: [[cn, givenName, uid, affiliation,
mail]]>
2018-02-26 15:36:46,733 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Found and added default attribute for release: [cn]>
2018-02-26 15:36:46,734 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Found and added default attribute for release: [givenName]>
2018-02-26 15:36:46,744 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Found and added default attribute for release: [uid]>
2018-02-26 15:36:46,744 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Found and added default attribute for release: [mail]>
2018-02-26 15:36:46,745 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Default attributes found to be released are [{cn=[Toben Archer, Toben D
Archer], givenName=Toben, [email protected], uid=uid}]>
2018-02-26 15:36:46,745 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Adding default attributes first to the released set of attributes>
2018-02-26 15:36:46,745 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Adding policy attributes to the released set of attributes>
2018-02-26 15:36:46,746 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Final collection of attributes allowed are: [{cn=[Toben Archer, Toben D
Archer], givenName=Toben, [email protected], uid=uid}]>
That looks good! That looks like everything I wanted it to say. excep this
part "Attribute policy [ReturnAllowedAttributeReleasePolicy] allows release
of [{}] for [toben.archer]" seems to contradict this part "Final collection
of attributes allowed are: [{cn=[Toben Archer, Toben D Archer],
givenName=Toben, [email protected], uid=uid}]". But anyway, it
looks like the attributes that I should be seeing in my cas request are
there, cn, givenName, and mail all look right (uid=uid is wrong, but it
should at least be present).
I had some concern that maybe something was going wrong in my library, so I
tweaked it to give me the raw XML output:
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>toben.archer</cas:user>
</cas:authenticationSuccess>
</cas:serviceResponse>
The attributes should be in this xml right?
On Friday, February 23, 2018 at 4:28:55 PM UTC-6, rbon wrote:
>
> In the project in etc/cas/config there is a log4j.xml.
>
> When you say 'gradle to build CAS' do you mean the
> cas-gradle-overlay-template or cas proper? Use an overlay unless you are
> planning on developing CAS. https://github.com/apereo/
>
> Ray
>
> On Fri, 2018-02-23 at 13:57 -0800, Toby Archer wrote:
>
> That sounds like a good idea. Pardon my ignorance, but I'm not sure where
> to place those logger definitions. I'm using gradle to build CAS and I
> don't see any xml files in the build process or in the configuration files.
>
> On Friday, February 23, 2018 at 3:39:31 PM UTC-6, rbon wrote:
>
> Toby,
>
> You may need to adjust your service (service registry) to allow the
> attributes to be released.
> These log settings may be useful:
> <!-- WARN DN resolution failed - TODO investigate this
> Requested LDAP attribute [???] ... -->
> <AsyncLogger
> name="org.apereo.cas.authentication.LdapAuthenticationHandler"
> level="debug" />
>
> <!-- DEBUG Found principal attributes [...] for [username]
> Attribute policy [???] allows release of [...] for
> [username]
> Final collection of attributes allowed are: [...] -->
> <AsyncLogger
> name="org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy"
>
> level="debug"/>
>
> Ray
>
> On Fri, 2018-02-23 at 12:36 -0800, Toby Archer wrote:
>
> I'm trying to figure out how to do attribute release and haven't gotten
> anywhere. I've read all the pages like this one:
> https://apereo.github.io/cas/5.1.x/integration/Attribute-Release-Policies.html
>
> and tried searching this mailing list and followed instructions like in
> this one:
> https://groups.google.com/a/apereo.org/forum/#!searchin/cas-user/attribute/cas-user/VVaONIp1Ts0/Hedpv2uGAwAJ
>
> Right now I'm using ldap for both authentication and attributes. The
> relevant part of my cas.properties file looks like this:
>
> # LDAP Auth
> cas.authn.ldap[0].type=AUTHENTICATED
> cas.authn.ldap[0].ldapUrl=ldap://usd-ldap.usd.edu
> cas.authn.ldap[0].baseDn=o=usd.edu
> cas.authn.ldap[0].userFilter=uid=%u
> cas.authn.ldap[0].subtreeSearch=true
> cas.authn.ldap[0].bindDn=cn=Directory Manager
> cas.authn.ldap[0].bindCredential=password
> cas.authn.ldap[0].userFilter=uid={user}
> cas.authn.ldap[0].dnFormat=uid=%s,ou=people
> cas.authn.ldap[0].keystore=file:/etc/cas/thekeystore
> cas.authn.ldap[0].keyStorePassword=password
> cas.authn.ldap[0].name=dev-ldap7-1
>
> cas.authn.ldap[0].allowMissingPrincipalAttributeValue=true
> cas.authn.ldap[0].principalAttributeList=cn,sn,mail
>
> cas.authn.attributeRepository.defaultAttributesToRelease=cn,sn,mail
>
> cas.authn.attributeRepository.stub.attributes.uid=uid
> cas.authn.attributeRepository.stub.attributes.displayName=displayName
> cas.authn.attributeRepository.stub.attributes.cn=commonName
>
> cas.authn.attributeRepository.ldap[0].type=AUTHENTICATED
> cas.authn.attributeRepository.ldap[0].ldapUrl=ldap://usd-ldap.usd.edu
> cas.authn.attributeRepository.ldap[0].baseDn=o=usd.edu
> cas.authn.attributeRepository.ldap[0].userFilter=uid=%u
> cas.authn.attributeRepository.ldap[0].subtreeSearch=true
> cas.authn.attributeRepository.ldap[0].bindDn=cn=Directory Manager
> cas.authn.attributeRepository.ldap[0].bindCredential=password
> cas.authn.attributeRepository.ldap[0].userFilter=uid={user}
> cas.authn.attributeRepository.ldap[0].dnFormat=uid=%s,uo=people
> cas.authn.attributeRepository.ldap[0].keystore=file:/etc/cas/thekeystore
> cas.authn.attributeRepository.ldap[0].keyStorePassword=password
> cas.authn.attributeRepository.ldap[0].name=dev-ldap7-1
>
> cas.authn.attributeRepository.ldap[0].uid=uid
> cas.authn.attributeRepository.ldap[0].displayName=displayName
> cas.authn.attributeRepository.ldap[0].cn=commonName
> cas.authn.attributeRepository.ldap[0].mail=mail
> cas.authn.attributeRepository.ldap[0].sn=sn
>
> There are configurations for a couple of different attempts, but
> regardless of what I do get back no attributes. The docs talk about the
> personDirectory but either don't give instructions on how to configure it
> or give instructions for cas 4. I'm at a bit of a loss on what to do. Any
> advise out there?
>
> --
> Ray Bon
> Programmer analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected]
>
>
> --
> Ray Bon
> Programmer analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected] <javascript:>
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/4b0b6ea4-1c07-4351-a73a-69ca16d595c4%40apereo.org.
