I am using CAS as an OAuth2 server with REST Authentication. My client is a javascript application using the oauth2 password grant type.
When trying to authenticate a user whose password is expired, my REST authentication endpoint is returning a 428 response as expected. I see a log message that indicates as much: INFO [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <[RestAuthenticationHandler] exception details: [Account password must change for [email protected]].> However, my client application just receives a generic 401 response from CAS indicating the authentication failed, without any indication that the password was expired. Is this the expected behavior? Am I missing any configuration that would allow CAS to return a different response or header or response code to an OAuth2 Password Grant Type request? I'd like to be able to relay to the client that authentication failed because the password is expired. I've tried returning both the X-CAS-Warning and X-CAS-PasswordExpirationDate response headers from my REST Authentication endpoint, but they do not get propagated to the response to my Oauth client from CAS. I also enabled the password management module, but that didn't seem to help either. cas.authn.pm.core.enabled=true cas.authn.pm.webflow.enabled=true cas.authn.pm.enabled=true I'm currently using CAS version 6.2.5. Thanks, Ken -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/e7099de8-36db-401a-bad4-95abf7beacbfn%40apereo.org.
