Hello, We succesfully configured CAS 5.2.2 to delegate authentication to an external provider through generic OAuth2 properties:
#(Optional) Friendly name for OAuth 2 provider, e.g. "This Organization" or "That Organization" cas.authn.pac4j.oauth2[0].clientName=Giltza Oauth 2 cas.authn.pac4j.oauth2[0].id=xxx cas.authn.pac4j.oauth2[0].secret=xxx cas.authn.pac4j.oauth2[0].authUrl=https://eidasdes.izenpe.com:8082/trustedx-authserver/izenpe/oauth cas.authn.pac4j.oauth2[0].tokenUrl=https://eidasdes.izenpe.com:8082/trustedx-authserver/izenpe/oauth/token cas.authn.pac4j.oauth2[0].profileUrl=https://eidasdes.izenpe.com:8082/trustedx-resources/openid/v1/users/me cas.authn.pac4j.oauth2[0].profileVerb=GET #cas.authn.pac4j.oauth2[0].profilePath= cas.authn.pac4j.oauth2[0].customParams.client_id=xxx cas.authn.pac4j.oauth2[0].customParams.response_type=code cas.authn.pac4j.oauth2[0].customParams.state=123456 cas.authn.pac4j.oauth2[0].customParams.acr_values=urn:safelayer:tws:policies:authentication:flow:bakq|urn:safelayer:tws:policies:authentication:flow:cert cas.authn.pac4j.oauth2[0].customParams.scope=urn:izenpe:identity:global cas.authn.pac4j.oauth2[0].profileAttrs.name=name cas.authn.pac4j.oauth2[0].profileAttrs.surname1=surname1 cas.authn.pac4j.oauth2[0].profileAttrs.surname2=surname2 ... If we don't do anything else, the following error occurs: [8/11/18 13:28:57:621 CET] 000000d3 SystemOut O 2018-11-08 13:28:57,611 DEBUG [org.pac4j.oauth.client.GenericOAuth20Client] - <profile: #OAuth20Profile# | *id: null* | attributes: {sub=978fa4ff4ea06ca1d39f35eb728b5a7e, cif=Q3890349H, country=ES, birthdate=EMPTY, key_usage=EMPTY, subject=SERIALNUMBER=99999988J, OID.2.5.4.4=#0C08464943544943494F, OID.2.5.4.42=#0C07434F5250524543, CN=CORPREC FICTICIO ACTIVO, OID.2.5.4.46=#131D2D646E692039393939393938384A202D63696620513338393033343948, OU=Condiciones de uso en www.izenpe.com nola erabili jakiteko, OU=Ziurtagiri korporatibo onartua - Cert. corporativo reconocido, O=IZENPE, C=ES, not_before=2017-03-16T12:15:29Z, tsl=S, issuer=CN=CA personal de AAPP vascas (2) - DESARROLLO, OU=AZZ Ziurtagiri publikoa - Certificado publico SCA, O=IZENPE S.A., C=ES, acr=urn:safelayer:tws:policies:authentication:flow:cert, surname1=FICTICIO, surname2=ACTIVO, email=EMPTY, dni=99999988J, tipoAfirma=0, firmaCualificada=S, naturalPersonSemanticsIdentifier=IDCES-99999988J, legalPersonSemanticsIdentifier=VATES-Q3890349H, serial_number=C6o=, given_name=CORPREC, pais=ES, not_after=2021-03-16T12:15:29Z, access_token=fc6ccaad705c4363cce28d89b7a3fd45897400c6134afd3c18d2d7a8bc8261a2, register_type=1, policy_identifier=1.3.6.1.4.1.14777.104.2, person_status=PF, domain=izenpe, organization=EMPTY, name=CORPREC FICTICIO ACTIVO, family_name=FICTICIO ACTIVO} | roles: [] | permissions: [] | isRemembered: false | clientName: null | linkedId: null |> [8/11/18 13:28:57:621 CET] 000000d3 SystemOut O 2018-11-08 13:28:57,611 ERROR [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <Authentication has failed. Credentials may be incorrect or CAS cannot find authentication handler that supports [org.apereo.cas.authentication.principal.ClientCredential@2cf6f06a[id=<null>]] of type [ClientCredential].> [8/11/18 13:28:57:621 CET] 000000d3 SystemOut O 2018-11-08 13:28:57,616 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN ============================================================= WHO: null WHAT: Supplied credentials: [org.apereo.cas.authentication.principal.ClientCredential@2cf6f06a[id=<null>]] ACTION: AUTHENTICATION_SUCCESS APPLICATION: CAS WHEN: Thu Nov 08 13:28:57 CET 2018 CLIENT IP ADDRESS: 127.0.0.1 SERVER IP ADDRESS: 127.0.0.1 ============================================================= [8/11/18 13:28:57:629 CET] 000000d3 SystemOut O 2018-11-08 13:28:57,628 ERROR [com.ibm.ws.webcontainer.servlet.ServletWrapper] - <SRVE0014E: Uncaught service() exception root cause dispatcherServlet: org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.webflow.execution.ActionExecutionException: Exception thrown executing org.apereo.cas.support.pac4j.web.flow.DelegatedClientAuthenticationAction@f990386 in state 'clientAction' of flow 'login' -- action execution attributes were 'map[[empty]]' In order to solve the problem we modified the class GenericOAuth20ProfileDefinition.java of pac4j-oauth-2.3.1.jar. We just set an id for the profile. @Override public OAuth20Profile extractUserProfile(String body) throws HttpAction { final OAuth20Profile profile = new OAuth20Profile(); final JsonNode json = JsonHelper.getFirstNode(body, getFirstNodePath()); if (json != null) { * profile.setId(JsonHelper.getElement(json, "name"));* for (final String attribute : getPrimaryAttributes()) { convertAndAdd(profile, attribute, JsonHelper.getElement(json, attribute)); } for (final String attribute : getSecondaryAttributes()) { convertAndAdd(profile, attribute, JsonHelper.getElement(json, attribute)); } for (final Map.Entry<String, String> entry : getProfileAttributes().entrySet()) { final String key = entry.getKey(); final String value = entry.getValue(); convertAndAdd(profile, key, JsonHelper.getElement(json, value)); } } return profile; } We think this is very ugly. Is there any other way to solve this problem without modifying pac4j source code ??? Thank you so much! -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/04383633-87ab-46ec-abda-70daee84928c%40apereo.org.
