Matt, You could be an ass and tell the user 'do not use safari'.
But my experience is that safari holds on to odd bits of session data. New sessions are not fulfilled because old session data is being sent. Have the user close safari (the application, not just the window), clear cookies, cache, etc. Ray On Wed, 2020-03-11 at 16:02 -0700, Matthew Uribe wrote: Hi everyone, I'm wondering if anyone else has seen something like this: (Environment: CAS 5.3.15.1, AD auth, Hazelcast ticket registry.) I had a report of someone not being able to access a particular service after successfully logging in to CAS (using Safari on iPad and iPhone). It application logs led me to believe that it was not getting the expected attributes from CAS/AD. This is what I saw in the cas.log: [result=Service Access Granted,service=https://m*****.aims.edu/s******/i****,principal=SimplePrincipal(id=j***** , attributes={}),requiredAttributes={}] That same user, using another browser was able to access the service, and this is what I then saw in the log: [result=Service Access Granted,service=https://m*****.aims.edu/s******/i****,principal=SimplePrincipal(id=j*****, attributes={is_stu=Y, uid=j*****, upn=j*****@aims.edu, mail=j*****@aims.edu, UDC_IDENTIFIER=********************************, displayName=J*********, givenName=J****, roles=ActiveStudent, cn=*********, memberOf=[CN=All Students,OU=*******,OU=******,OU=******************,DC=aims,DC=edu, CN=roleStudentActive,OU=*******,OU=******,OU=******************,DC=aims,DC=edu], sn=****}),requiredAttributes={}] In the above examples, one session had an empty set of attributes, attributes={}, while the other had a full set of attributes, attributes={...,...,...,...,...etc...}. The only difference that I'm aware of is moving off of Safari on the client side. Why would a specific browser impact the release of attributes from the CAS server, to the service? Is there something I should be looking at on the server configuration? Below is the AD configuration: #Prod Active Directory setup cas.authn.ldap[0].order: 0 cas.authn.ldap[0].name: Prod Active Directory cas.authn.ldap[0].type: AD cas.authn.ldap[0].ldapUrl: ldaps://${dc.1}.aims.edu cas.authn.ldap[0].validatePeriod: 270 cas.authn.ldap[0].poolPassivator: NONE cas.authn.ldap[0].SearchFilter: sAMAccountName={user} cas.authn.ldap[0].baseDn: dc=aims,dc=edu cas.authn.ldap[0].dnFormat: %[email protected] #AD attribute resolution cas.authn.attributeRepository.ldap[0].order: 0 cas.authn.attributeRepository.ldap[0].ldapUrl: ldaps://${dc.1}.aims.edu cas.authn.attributeRepository.ldap[0].validatePeriod: 270 cas.authn.attributeRepository.ldap[0].SearchFilter: sAMAccountName={user} cas.authn.attributeRepository.ldap[0].baseDn: dc=aims,dc=edu cas.authn.attributeRepository.ldap[0].bindDn: cn=***,ou=***,dc=aims,dc=edu cas.authn.attributeRepository.ldap[0].bindCredential: *** cas.authn.attributeRepository.ldap[0].attributes.cn: uid cas.authn.attributeRepository.ldap[0].attributes.displayName: displayName cas.authn.attributeRepository.ldap[0].attributes.givenName: givenName cas.authn.attributeRepository.ldap[0].attributes.mail: mail cas.authn.attributeRepository.ldap[0].attributes.sn: sn cas.authn.attributeRepository.ldap[0].attributes.customPersonCollegeCode: UDC_IDENTIFIER cas.authn.attributeRepository.ldap[0].attributes.customPersonAlternateID: cn cas.authn.attributeRepository.ldap[0].attributes.customPersonEmployeeStatus: is_empl cas.authn.attributeRepository.ldap[0].attributes.customPersonFacStatus: is_facl cas.authn.attributeRepository.ldap[0].attributes.customPersonEmployeeTypeStudent: is_stu cas.authn.attributeRepository.ldap[0].attributes.customPersonStatusStudent: is_stu cas.authn.attributeRepository.ldap[0].attributes.customPersonRoles: roles cas.authn.attributeRepository.ldap[0].attributes.MemberOf: memberOf cas.authn.attributeRepository.ldap[0].attributes.UserPrincipalName: upn The service is defined as: { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^https://m*****.aims.edu(\\z|/.*)", "name" : "m************", "id" : 15********, "attributeReleasePolicy" : { "@class" : "org.apereo.cas.services.ReturnAllAttributeReleasePolicy" }, "multifactorPolicy" : { "@class" : "org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy", "multifactorAuthenticationProviders" : [ "java.util.LinkedHashSet", [ "mfa-duo" ] ] }, "evaluationOrder" : 10 } Thanks everyone. Matt Uribe -- Ray Bon Programmer Analyst Development Services, University Systems 2507218831 | CLE 019 | [email protected]<mailto:[email protected]> I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/07da011cbeb5202ede86ba1dad66308b94673fe1.camel%40uvic.ca.
