Alberto, My apologies. I missed the part about cas protocol v2. Attribute release is available only with protocol v3 and saml 1.1 (and saml 2).
Ray On Mon, 2019-11-04 at 13:17 +0100, Alberto Cabello Sánchez wrote: On Fri, 25 Oct 2019 18:08:13 +0000 Ray Bon < <mailto:[email protected]> [email protected] > wrote: Alberto, To be sure CAS is releasing the attributes: <!-- DEBUG Found principal attributes [...] for [username] Attribute policy [???] allows release of [...] for [username] Final collection of attributes allowed are: [...] --> <AsyncLogger name="org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy" level="debug"/> Thanks, Ray. It seems to be right: DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] <Final collection of attributes allowed are: [{cn=[alberto], givenName=[alberto], irisPersonalUniqueID=[DOC:12345678R], mail=[ <mailto:[email protected]> [email protected] ], sn=[cabello sánchez], sn1=[cabello], sn2=[sánchez], uid=[alberto]}]> I wonder how the "serviceValidate" endpoint is building the service response. Could this be useful? The log shows attributes being used for access control WHO: audit:unknown WHAT: [result=Service Access Granted,service= <https://server.unex.es/examples/jsp/he...,principal=SimplePrincipal(id=alberto> https://server.unex.es/examples/jsp/he...,principal=SimplePrincipal(id=alberto , attributes={cn=[alberto], givenName=[alberto], irisPersonalUniqueID=[DOC:12345678R], mail=[ <mailto:[email protected]> [email protected] ], sn=[cabello sánchez], sn1=[cabello], sn2=[sánchez], uid=[alberto]}),requiredAttributes={}] ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED APPLICATION: CAS but not for service ticket validation WHO: alberto WHAT: ST-16c60*******************d099 for <https://server.unex.es/examples/jsp/headers.jsp> https://server.unex.es/examples/jsp/headers.jsp ACTION: SERVICE_TICKET_VALIDATED APPLICATION: CAS Additionally: I can use attributes to control access in .htaccess (with Require cas-attribute givenName:alberto) but -as expected- it works for me only in the SAML scenario, not in the CASv2. -- Alberto Cabello Sánchez Servicio de Informática Universidad de Extremadura -- Ray Bon Programmer Analyst Development Services, University Systems 2507218831 | CLE 019 | [email protected]<mailto:[email protected]> I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2e8fac5c9572d6e77afdd446193a23691e07ccc2.camel%40uvic.ca.
