Hello list,
I hope someone can help me, I'm trying to use CAS 6.3 as an OIDC identity
provider to a Keycloak server version 12.0.4, however I only get the
"Service Not Authorized" page from CAS.
Both servers are already up and authenticating just fine.
I've configured the Keycloak service in CAS with very minimalist json
configuration, as follows:
{
"@class": "org.apereo.cas.services.OidcRegisteredService",
"clientId": "keycloak-sdr-oidc",
"clientSecret": "<secret>",
"serviceId": "<keycloak-url>/broker/cas-server-lab-oidc/endpoint",
"name": "Keycloak",
"id": 1008
}
I've configured CAS as an IDP using Keycloak GUI, passing the
/oidc/.well-known URL which is working, and Keycloak autoconfigures itself,
I just needed to input the clientSecret key. The serviceId configured above
is the redirect uri Keycloak gives.
Authenticating with Keycloak and clicking on the CAS provider button, I get
the following URL:
<cas-url>/oidc/authorize?scope=openid&state=0qSqbtCYF_DWyzLXRyiZldn2uP64J6esXeiP6UlVfNw.guRTVBHiRKw.sample-client&response_type=code&client_id=keycloak-sdr-oidc&redirect_uri=<keycloak-redirect-uri-encoded>&nonce=372Y_32lOgVg5IQDmna_mA
This gives me only the Service Not Authorized CAS page.
CAS log shows this:
-
org.apereo.cas.support.oauth.validator.authorization.OAuth20AuthorizationCodeResponseTypeAuthorizationRequestValidator
[WARN] Registered service [null] is not found or is not authorized for
access.
-
org.apereo.cas.support.oauth.web.endpoints.OAuth20AuthorizeEndpointController
[ERROR] Authorize request verification failed. Authorization request is
missing required parameters, or the request is not authenticated and
contains no authenticated profile/principal.
I'm pretty sure my service is being loaded, I get these log msgs (I use git
service registry)
- org.apereo.cas.services.GitServiceRegistry [DEBUG] Successfully pulled
changes from the remote repository
- org.apereo.cas.services.AbstractServicesManager [INFO] Loaded [2]
service(s) from [GitServiceRegistry].
Any hints would be appreciated, thanks in advance.
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/02edaf42-bbf4-494f-930e-3eec877d6084n%40apereo.org.
