Nevermind. I missunderstood the documentation. Needed to add
cas.authn.surrogate.ldap.surrogateSearchFilter=(&(uid={user})(userType=admin))
in my cas.properties.
Marcel Fromkorth schrieb am Freitag, 8. Januar 2021 um 11:39:21 UTC+1:
> Forgot to say: It's CAS Version 6.2.5.
>
> Marcel Fromkorth schrieb am Freitag, 8. Januar 2021 um 11:22:25 UTC+1:
>
>>
>> Hello,
>>
>> I'm trying to configure some required attributes for the primary user in
>> an surrogate authentication process.
>>
>> My service-JSON-File looks like this (for local testing):
>>
>> {
>> "@class" : "org.apereo.cas.services.RegexRegisteredService",
>> "serviceId" : "^https://localhost:8443/test/.*";,
>> "name" : "localhosttest",
>> "id" : 10000001,
>> "logoutType" : "FRONT_CHANNEL",
>> "logoutUrl" : "https://localhost:8443/test/logout";,
>> "attributeReleasePolicy" : {
>> "@class" : "org.apereo.cas.services.ReturnAllAttributeReleasePolicy"
>> },
>> "accessStrategy" : {
>> "@class" :
>> "org.apereo.cas.services.SurrogateRegisteredServiceAccessStrategy",
>> "enabled" : true,
>> "surrogateEnabled" : true,
>> "ssoEnabled" : true,
>> "requiredAttributes" : {
>> "@class" : "java.util.HashMap",
>> "authorizedService" : [ "java.util.HashSet", [ "testService" ] ]
>> },
>> "surrogateRequiredAttributes" : {
>> "@class" : "java.util.HashMap",
>> "userType" : [ "java.util.HashSet", [ "admin" ] ]
>> }
>> }
>> }
>>
>> Unfortunately, it doesn't work.
>>
>> So the surrogate authentication itself works fine with the syntax
>> surrogateUser+primaryUser, but the "surrogateRequiredAttributes" will be
>> ignored. At the moment any user can use the surrogate feature, but it
>> should be restricted, that only users with the userType admin can use it.
>>
>> Also in the cas server logs there is no note about this required
>> attributes.
>> Only the normal "requiredAttributes" were noticed there:
>>
>> ,requiredAttributes={authorizedService=[testService]}]
>>
>> but nothing for the surrogate. Like its not enabled or something like
>> that...
>>
>> Is there an option I need to activate or configure, that the
>> "surrogateRequiredAttributes" wont be ignored?
>>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/1f26eb65-c51f-4434-a7d3-0ee8b4a38995n%40apereo.org.
