Hi,
Yes, things are a bit tricky with the delegation redirection feature.
Which version of the CAS server do you use?
With v7.2.2, you should define:
"accessStrategy": {
"@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
"enabled": true,
"ssoEnabled": true,
"delegatedAuthenticationPolicy" : {
"@class" :
"org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy"
,
"allowedProviders" : [ "java.util.ArrayList", [ ] ],
"permitUndefined": false,
"exclusive": false
}
}
Thanks.
Best regards,
Jérôme
Le vendredi 9 mai 2025 à 19:42:29 UTC+2, Pablo Vidaurri a écrit :
> I have a oidc delegated service to azure and it has
> cas.authn.pac4j.oidc[0].generic.client-name=AzureClient
> cas.authn.pac4j.oidc[0].generic.auto-redirect-type=SERVER
>
> I then have a few service files that have:
> "accessStrategy": {
> "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy"
> ,
> "enabled": true,
> "ssoEnabled": true,
> "delegatedAuthenticationPolicy" : {
> "@class" :
> "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy"
> ,
> "allowedProviders" : [ "java.util.ArrayList", [ "AzureClient"] ],
> "permitUndefined": false,
> "exclusive": true
> }
> }
>
> Auto redirect to Azure works well.
>
> But now I have another service that should not redirect and instead login
> via the cas/login page. For that, my service file simply has this for
> acceessStragegy:
> "accessStrategy": {
> "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy"
> ,
> "enabled": true,
> "ssoEnabled": true
> },
>
> But this is still redirecting to the AzureClient.
> If I remove
> cas.authn.pac4j.oidc[0].generic.auto-redirect-type=SERVER
> from config, it is then not redirecting my clients intended for delegated
> login to AzureClient.
>
> Any workarounds or something that I am missing? I also made sure the
> evaluationOrder looks for services meant for cas/login authentication first.
>
> Another strange thing regarding evalutionOrder, I thought first one it
> finds is the one it uses. But i see in the logs, CAS is going thru each one
> with messages like
>
> WHAT: {result=Client Access Granted,
> WHAT: {result=Client Access Denied,
> WHAT: {result=Client Access Granted,
>
> regex matches both 1st and 3rd but i want 1st one (more specific regex) to
> be used.
>
> -psv
>
>
>
--
- Website: https://apereo.github.io/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/95adf015-6371-4726-a57c-b78f9caca790n%40apereo.org.
