Please be noticed that:
serviceId should be exact same as redirect_uri in /oidc/authorize call.
e.g.
<CAS URL>/oidc/authorize?response_type=code&*redirect_uri*
=https://test.com/demo123
*serviceId*="^https://test.com/demo123";
Ray Bon在 2021年10月20日星期三上午8:16:36 [UTC+8]寫道：
> Alcides,
>
> Try this logger to see what services are being loaded
>
> <!-- DEBUG service definitions -->
> <AsyncLogger
> name="org.apereo.cas.adaptors.ldap.services.DefaultLdapRegisteredServiceMapper"
>
> level="debug" />
>
> Ray
>
> On Tue, 2021-10-19 at 15:10 -0700, Alcides Moraes wrote:
>
> Notice: This message was sent from outside the University of Victoria
> email system. Please be cautious with links and sensitive information.
>
>
> Hello list,
>
> I hope someone can help me, I'm trying to use CAS 6.3 as an OIDC identity
> provider to a Keycloak server version 12.0.4, however I only get the
> "Service Not Authorized" page from CAS.
> Both servers are already up and authenticating just fine.
>
> I've configured the Keycloak service in CAS with very minimalist json
> configuration, as follows:
>
> {
> "@class": "org.apereo.cas.services.OidcRegisteredService",
> "clientId": "keycloak-sdr-oidc",
> "clientSecret": "<secret>",
> "serviceId": "<keycloak-url>/broker/cas-server-lab-oidc/endpoint",
> "name": "Keycloak",
> "id": 1008
> }
>
> I've configured CAS as an IDP using Keycloak GUI, passing the
> /oidc/.well-known URL which is working, and Keycloak autoconfigures itself,
> I just needed to input the clientSecret key. The serviceId configured above
> is the redirect uri Keycloak gives.
>
> Authenticating with Keycloak and clicking on the CAS provider button, I
> get the following URL:
>
> <cas-url>/oidc/authorize?scope=openid&state=0qSqbtCYF_DWyzLXRyiZldn2uP64J6esXeiP6UlVfNw.guRTVBHiRKw.sample-client&response_type=code&client_id=keycloak-sdr-oidc&redirect_uri=<keycloak-redirect-uri-encoded>&nonce=372Y_32lOgVg5IQDmna_mA
>
> This gives me only the Service Not Authorized CAS page.
>
> CAS log shows this:
>
> -
>
> org.apereo.cas.support.oauth.validator.authorization.OAuth20AuthorizationCodeResponseTypeAuthorizationRequestValidator
>
> [WARN] Registered service [null] is not found or is not authorized for
> access.
> -
>
> org.apereo.cas.support.oauth.web.endpoints.OAuth20AuthorizeEndpointController
> [ERROR] Authorize request verification failed. Authorization request
> is missing required parameters, or the request is not authenticated and
> contains no authenticated profile/principal.
>
> I'm pretty sure my service is being loaded, I get these log msgs (I
> use git service registry)
> - org.apereo.cas.services.GitServiceRegistry [DEBUG] Successfully
> pulled changes from the remote repository
> - org.apereo.cas.services.AbstractServicesManager [INFO] Loaded [2]
> service(s) from [GitServiceRegistry].
>
>
> Any hints would be appreciated, thanks in advance.
>
> --
>
> Ray Bon
> Programmer Analyst
> Development Services, University Systems
> 2507218831 <(250)%20721-8831> | CLE 019 | [email protected]
>
> I acknowledge and respect the lək̓ʷəŋən peoples on whose traditional
> territory the university stands, and the Songhees, Esquimalt and WSÁNEĆ
> peoples whose historical relationships with the land continue to this day.
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/09d820c1-d3ae-489b-815e-5023e54a7c8fn%40apereo.org.
