Hi All, I am working on a CAS 6.3 deployment where we need to configure multiple directories for authentication using LDAP.
I have both LDAP sources configured and working with LPPE enabled but I need to change the authentication behavior slightly. If the user is found in the first directory and authentication fails, I need the authentication process to stop. The second directory should not be queried if the first has a user record with a different password than what the user entered. If no record is found for the user in the first directory, the authentication process should continue on through the chain. I thought I'd be able to use an existing Authentication Policy but I don't see any that match my goal. https://apereo.github.io/cas/6.3.x/configuration/Configuration-Properties.html#authentication-policy I don't want it to allow 'any' and I don't want to specify one or the other as required. LLPE doesn't process the exception since there is no entry in the errorMap object for 'LOGON_FAILURE'. After processing the first result CAS moves on to check the next 'GENERIC' directory: 2021-01-01 19:21:32,215 DEBUG [org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] - <Handling LDAP account state error [LOGON_FAILURE]> 2021-01-01 19:21:32,215 DEBUG [org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] - <No LDAP error mapping defined for [LOGON_FAILURE]> 2021-01-01 19:21:32,215 DEBUG [org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] - <Handling account state warning [null]> 2021-01-01 19:21:32,215 DEBUG [org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] - <Account state warning not defined> 2021-01-01 19:21:32,216 INFO [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <[AD] exception details: [Invalid credentials].> 2021-01-01 19:21:32,216 DEBUG [org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler] - <Examining credential [UsernamePasswordCredential(username=testaccount, source=null, customFields={})] eligibility for authentication handler [GENERIC]> With so many configurable options, it seems like there should be a way to accomplish this without writing code. Right now I'm looking at modifying the DefaultAccountStateHandler to include a mapping in errorMap for 'LOGIN_FAILURE'. I'm not 100% sure that will work the way I need it to but it seems like a fairly straightforward option and modification. Thanks!! Tom -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB665506502F74EA8261B96008CBD50%40MN2PR02MB6655.namprd02.prod.outlook.com.
