Forgot to say: It's CAS Version 6.2.5.
Marcel Fromkorth schrieb am Freitag, 8. Januar 2021 um 11:22:25 UTC+1:
>
> Hello,
>
> I'm trying to configure some required attributes for the primary user in
> an surrogate authentication process.
>
> My service-JSON-File looks like this (for local testing):
>
> {
> "@class" : "org.apereo.cas.services.RegexRegisteredService",
> "serviceId" : "^https://localhost:8443/test/.*";,
> "name" : "localhosttest",
> "id" : 10000001,
> "logoutType" : "FRONT_CHANNEL",
> "logoutUrl" : "https://localhost:8443/test/logout";,
> "attributeReleasePolicy" : {
> "@class" : "org.apereo.cas.services.ReturnAllAttributeReleasePolicy"
> },
> "accessStrategy" : {
> "@class" :
> "org.apereo.cas.services.SurrogateRegisteredServiceAccessStrategy",
> "enabled" : true,
> "surrogateEnabled" : true,
> "ssoEnabled" : true,
> "requiredAttributes" : {
> "@class" : "java.util.HashMap",
> "authorizedService" : [ "java.util.HashSet", [ "testService" ] ]
> },
> "surrogateRequiredAttributes" : {
> "@class" : "java.util.HashMap",
> "userType" : [ "java.util.HashSet", [ "admin" ] ]
> }
> }
> }
>
> Unfortunately, it doesn't work.
>
> So the surrogate authentication itself works fine with the syntax
> surrogateUser+primaryUser, but the "surrogateRequiredAttributes" will be
> ignored. At the moment any user can use the surrogate feature, but it
> should be restricted, that only users with the userType admin can use it.
>
> Also in the cas server logs there is no note about this required
> attributes.
> Only the normal "requiredAttributes" were noticed there:
>
> ,requiredAttributes={authorizedService=[testService]}]
>
> but nothing for the surrogate. Like its not enabled or something like
> that...
>
> Is there an option I need to activate or configure, that the
> "surrogateRequiredAttributes" wont be ignored?
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/9e7cccd3-8e51-4f01-8f04-96c87712b83bn%40apereo.org.
