On Fri, 25 Oct 2019 18:08:13 +0000
Ray Bon <[email protected]> wrote:
> Alberto,
>
> To be sure CAS is releasing the attributes:
>
> <!-- DEBUG Found principal attributes [...] for [username]
> Attribute policy [???] allows release of [...] for
> [username]
> Final collection of attributes allowed are: [...] -->
> <AsyncLogger
> name="org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy"
> level="debug"/>
Thanks, Ray.
It seems to be right:
DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy]
<Final collection of attributes allowed are: [{cn=[alberto],
givenName=[alberto], irisPersonalUniqueID=[DOC:12345678R],
mail=[[email protected]], sn=[cabello sánchez], sn1=[cabello], sn2=[sánchez],
uid=[alberto]}]>
I wonder how the "serviceValidate" endpoint is building the service response.
Could this be useful? The log shows attributes being used for access control
WHO: audit:unknown
WHAT: [result=Service Access
Granted,service=https://server.unex.es/examples/jsp/he...,principal=SimplePrincipal(id=alberto,
attributes={cn=[alberto], givenName=[alberto],
irisPersonalUniqueID=[DOC:12345678R], mail=[[email protected]], sn=[cabello
sánchez], sn1=[cabello], sn2=[sánchez], uid=[alberto]}),requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
but not for service ticket validation
WHO: alberto
WHAT: ST-16c60*******************d099 for
https://server.unex.es/examples/jsp/headers.jsp
ACTION: SERVICE_TICKET_VALIDATED
APPLICATION: CAS
Additionally: I can use attributes to control access in .htaccess (with
Require cas-attribute givenName:alberto) but -as expected- it works for me
only in the SAML scenario, not in the CASv2.
--
Alberto Cabello Sánchez
Servicio de Informática
Universidad de Extremadura
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/20191104131745.e9bf1d095e4c607b1214cc32%40unex.es.
