Hi all, I didn't find a way to get the attributes just via configuration, but I did it by implementing a custom PrincipalResolver which extends PersonDirectoryPrincipalResolver, and there, when in presence of SAML2Credentials, add my attribute retrieval method based on SAMLCredentialPersonAttributeDao. I then registered the new PrincipalResolver by adding a bean, with id "personDirectoryPrincipalResolver" and defined as primary, in deployerConfigContext.xml <https://toolbox.sia.eu/bitbucket/projects/PCAS/repos/cas5/browse/src/main/resources/deployerConfigContext.xml?at=refs%2Fheads%2Ffeature%2FPC-23-migrazione-a-cas-5> in src/main/resources. This way, any SAML2Credential can retrieve attributes from the IDP and pass them on to the autoconfigured Merging and Cache attribute repositories.
I hope this helps anyone else in the same situation. Alessandro Il giorno mer 23 ago 2017 alle ore 16:33 Andy Ng <[email protected]> ha scritto: > Although I don't have an answer to your problem and I can't really help > you most likely, I still want to suggest you try implementing something to > see if it works or not. > > In CAS 5.2.0-RC1 or above, there is a feature called "Attribute Repository > Merging" > > > https://apereo.github.io/2017/06/30/520rc1-release/#026-attribute-repository-merging > > From my use case, upgrading to CAS 5.2.0-RC1 seems to help with merging > the attribute through the authentication and principal solution process. > Since my use case is different from yours so I don't know whether it will > help you or not, but I think it might worth a try to upgrade your CAS > to 5.2.0-RC1 to try if attributes are released. > > -Andy > > > On Wednesday, 23 August 2017 15:00:12 UTC+8, Alessandro Putzu wrote: >> >> Anyone? More precisely, how can I add the >> SAMLCredentialPersonAttributeDao to the list of attribute repositories? >> I tried defining a deployerConfigContext.xml in my CAS overlay >> installation with a PersonDirectoryPrincipalResolver (and >> SAMLCredentialPersonAttributeDao) as attribute repository, set as primary >> bean, but it is not picked up when authenticating. >> >> Anyone has suggestions? >> Thanks in advance. >> >> Il giorno martedì 22 agosto 2017 16:28:16 UTC+2, Alessandro Putzu ha >> scritto: >>> >>> Hi everyone, I configured the CAS server with SAML 2 delegated IDP as in >>> the subject, but when I log in to CAS the SAML attributes are not cascaded >>> to the CAS client. The situation on the server is as follows: >>> >>> - The Service is configured with >>> "attributeReleasePolicy" : { >>> "@class" : >>> "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy", >>> "allowedAttributes" : [ "java.util.ArrayList", [ "nome", "userid", >>> "profilo", "email" ] ] >>> } >>> >>> - The Credential object is correctly populated and contains all >>> attributes from SAML. >>> - The method PersonDirectoryPrincipalResolver.resolve() retrieves the >>> correct Principal. >>> - The same method calls "retrievePersonAttributes(String, Credential)" >>> and there, attributes from the Credential object are silently discarded and >>> the Principal goes on with no attributes. >>> >>> On the docs >>> https://apereo.github.io/cas/5.1.x/integration/Attribute-Resolution.html >>> it is mentioned that it's possible to configure multiple Attribute >>> Repositories, but I couldn't find how to do so. Also I can't understand why >>> the attributes on the SAMLCredential resource are discarded. >>> >>> Can you help me? >>> Thanks in advance! >>> >> -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/0bf7298e-54e4-46fc-acfb-f3d7d7dcad66%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/0bf7298e-54e4-46fc-acfb-f3d7d7dcad66%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAJ5OwEfM%3DxL-Nm7FuWefi12WzcaacaMqm%3DYNF8DPnbM5mspxXw%40mail.gmail.com.
