Hi Jerome
I'm still on v6.6.15.1 ... looking to go to 7.2 soon but too many issue
that I'm facing with that version.
I managed to get it working by leaving my service files as posted above but
then setting
cas.authn.pac4j.oidc[0].generic.auto-redirect-type=SERVER
to value of NONE.
It is strange because from docs it looks like default value if not defined
will be NONE but it only started working after I explicitly set to NONE.
-psv
On Monday, May 19, 2025 at 2:21:25 AM UTC-5 leleuj wrote:
> Hi,
>
> Yes, things are a bit tricky with the delegation redirection feature.
>
> Which version of the CAS server do you use?
>
> With v7.2.2, you should define:
>
> "accessStrategy": {
> "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy"
> ,
> "enabled": true,
> "ssoEnabled": true,
> "delegatedAuthenticationPolicy" : {
> "@class" :
> "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy"
> ,
> "allowedProviders" : [ "java.util.ArrayList", [ ] ],
> "permitUndefined": false,
> "exclusive": false
> }
> }
>
> Thanks.
> Best regards,
> Jérôme
>
> Le vendredi 9 mai 2025 à 19:42:29 UTC+2, Pablo Vidaurri a écrit :
>
>> I have a oidc delegated service to azure and it has
>> cas.authn.pac4j.oidc[0].generic.client-name=AzureClient
>> cas.authn.pac4j.oidc[0].generic.auto-redirect-type=SERVER
>>
>> I then have a few service files that have:
>> "accessStrategy": {
>> "@class":
>> "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
>> "enabled": true,
>> "ssoEnabled": true,
>> "delegatedAuthenticationPolicy" : {
>> "@class" :
>> "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy"
>> ,
>> "allowedProviders" : [ "java.util.ArrayList", [ "AzureClient"] ],
>> "permitUndefined": false,
>> "exclusive": true
>> }
>> }
>>
>> Auto redirect to Azure works well.
>>
>> But now I have another service that should not redirect and instead login
>> via the cas/login page. For that, my service file simply has this for
>> acceessStragegy:
>> "accessStrategy": {
>> "@class":
>> "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
>> "enabled": true,
>> "ssoEnabled": true
>> },
>>
>> But this is still redirecting to the AzureClient.
>> If I remove
>> cas.authn.pac4j.oidc[0].generic.auto-redirect-type=SERVER
>> from config, it is then not redirecting my clients intended for delegated
>> login to AzureClient.
>>
>> Any workarounds or something that I am missing? I also made sure the
>> evaluationOrder looks for services meant for cas/login authentication first.
>>
>> Another strange thing regarding evalutionOrder, I thought first one it
>> finds is the one it uses. But i see in the logs, CAS is going thru each one
>> with messages like
>>
>> WHAT: {result=Client Access Granted,
>> WHAT: {result=Client Access Denied,
>> WHAT: {result=Client Access Granted,
>>
>> regex matches both 1st and 3rd but i want 1st one (more specific regex)
>> to be used.
>>
>> -psv
>>
>>
>>
--
- Website: https://apereo.github.io/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/fd27597b-a826-4c44-89ec-9d3766160530n%40apereo.org.
