Problmes with Oauth grant type Password - CAS 5.1.4

598 views
Skip to first unread message

Leo Pintos

unread,
Feb 6, 2018, 8:48:50 AM2/6/18
to CAS Community
Hi Guys!

I' ve working with curl command:
curl -X POST -k -i 'https://DOMAIN/cas/oauth2.0/accessToken?grant_type=password&client_id=app_prueba&username=USER&password=PASS&service=URLREDIRECTION'


JSON:
{
  "@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
  "clientId": "app_prueba",
  "clientSecret": "clientSecret",
  "bypassApprovalPrompt": true,
  "generateRefreshToken": false,
  "serviceId" : "^(https?)://.*",
  "name" : "MyOAuthservice",
  "id" : 10000002
}

Log;
2018-01-24 16:19:59,135 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-15) Could not identify and extract access token request: org.apereo.cas.services.UnauthorizedServiceException: Unauthorized Service Access. Service [app_prueba] is not found in service registry.
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(RegisteredServiceAccessStrategyUtils.java:53)
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(RegisteredServiceAccessStrategyUtils.java:69)
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensurePrincipalAccessIsAllowedForService(RegisteredServiceAccessStrategyUtils.java:85)
        at org.apereo.cas.DefaultCentralAuthenticationService.createTicketGrantingTicket(DefaultCentralAuthenticationService.java:362)
        at org.apereo.cas.DefaultCentralAuthenticationService$$FastClassBySpringCGLIB$$b02e48f2.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:85)
        at org.apereo.inspektr.audit.AuditTrailManagementAspect.handleAuditTrail(AuditTrailManagementAspect.java:134)
        at sun.reflect.GeneratedMethodAccessor156.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:629)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:618)
        at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:282)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673)
        at org.apereo.cas.DefaultCentralAuthenticationService$$EnhancerBySpringCGLIB$$e00035a3.createTicketGrantingTicket(<generated>)
        at sun.reflect.GeneratedMethodAccessor218.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:282)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
        at com.sun.proxy.$Proxy164.createTicketGrantingTicket(Unknown Source)
        at org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor.extract(AccessTokenPasswordGrantRequestExtractor.java:79)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.examineAndExtractAccessTokenGrantRequest(OAuth20AccessTokenEndpointController.java:189)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.handleRequest(OAuth20AccessTokenEndpointController.java:111)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController$$FastClassBySpringCGLIB$$db180f28.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
        at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController$$EnhancerBySpringCGLIB$$c3f88027.handleRequest(<generated>)
        at sun.reflect.GeneratedMethodAccessor219.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.boot.web.filter.ApplicationContextHeaderFilter.doFilterInternal(ApplicationContextHeaderFilter.java:55)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.apereo.cas.web.support.AuthenticationCredentialsLocalBinderClearingFilter.doFilter(AuthenticationCredentialsLocalBinderClearingFilter.java:28)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.apereo.cas.security.RequestParameterPolicyEnforcementFilter.doFilter(RequestParameterPolicyEnforcementFilter.java:261)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.apereo.cas.security.ResponseHeadersEnforcementFilter.doFilter(ResponseHeadersEnforcementFilter.java:238)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:110)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.apereo.cas.logging.web.ThreadContextMDCServletFilter.doFilter(ThreadContextMDCServletFilter.java:90)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:106)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115)
        at org.springframework.boot.web.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59)
        at org.springframework.boot.web.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.apereo.inspektr.common.web.ClientInfoThreadLocalFilter.doFilter(ClientInfoThreadLocalFilter.java:64)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
        at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
        at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
        at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
        at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
        at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
        at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
        at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
        at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

Any help?
Thank in advance.

Man H

unread,
Feb 6, 2018, 10:00:54 AM2/6/18
to cas-...@apereo.org
You should define app_prueba as a service 
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/0c3b4f53-faf6-49db-943a-a32da9955d01%40apereo.org.

Leo Pintos

unread,
Feb 6, 2018, 10:23:11 AM2/6/18
to CAS Community
Hi  Manfredo,

When I define Oauth service with (OAuthRegisteredService), Is not a Service registration?
Should I register the same service generically and for Oauth separately or can I do it in the same JSON?

You suggest me define app_prueba like a generic service like the follow JSON:
{
  /*
    Generic service definition that applies to https/imaps urls
    that wish to register with CAS for authentication.
  */
  "@class" : "org.apereo.cas.services.RegexRegisteredService",
  "serviceId" : "^(https?):.*",
  "name" : "HTTPS",
  "id" : 10000001,
}

When I define app_prueba with OAuthRegisteredService I assume its registration as a generic service.
Thank you for your support.
Leo.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

Man H

unread,
Feb 6, 2018, 10:55:41 AM2/6/18
to cas-...@apereo.org
yes

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e77e27a-8fab-49e1-9624-bd6aa59e8f0b%40apereo.org.

Doan Moon

unread,
Feb 6, 2018, 11:44:09 AM2/6/18
to Man H


From Man H
Sent 22:55 Thứ ba, ngày 6 tháng hai năm 2018
Subject Re: [cas-user] Problmes with Oauth grant type Password - CAS 5.1.4

Leo Pintos

unread,
Feb 6, 2018, 2:15:29 PM2/6/18
to CAS Community
Hi guys!

I continue with the same error using the service registry Json. Follow I Put de info;

Service registry JSON
{
  "@class" : "org.apereo.cas.services.RegexRegisteredService",
  "serviceId" : "URL_REDIRECTION",
  "name" : "app_prueba",
  "id" : 100,
}

Oauth JSON:

{
  "@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
  "clientId": "app_prueba",
  "clientSecret": "clientSecret",
  "bypassApprovalPrompt": true,
  "generateRefreshToken": false,
  "serviceId" : "URL_REDIRECTION",

  "name" : "MyOAuthservice",
  "id" : 10000002
}

Log:
2018-02-06 16:09:53,408 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-5) Could not identify and extract access token request: org.apereo.cas.services.UnauthorizedServiceException: Unauthorized Service Access. Service [app_prueba] is not found in service registry.

        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(RegisteredServiceAccessStrategyUtils.java:53)
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(RegisteredServiceAccessStrategyUtils.java:69)
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensurePrincipalAccessIsAllowedForService(RegisteredServiceAccessStrategyUtils.java:85)
        at org.apereo.cas.DefaultCentralAuthenticationService.createTicketGrantingTicket(DefaultCentralAuthenticationService.java:362)
        at org.apereo.cas.DefaultCentralAuthenticationService$$FastClassBySpringCGLIB$$b02e48f2.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)


Any help?
Thank in advance.
Leo.
yes

Man H

unread,
Feb 6, 2018, 4:57:45 PM2/6/18
to cas-...@apereo.org
is debug enabled
eg logging.level.org.apereo.cas=debug

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/b1e3123f-1bd8-426b-8587-706f463274f7%40apereo.org.

Anders Olsen

unread,
Feb 7, 2018, 4:21:02 AM2/7/18
to CAS Community
Hi Leo,

When you're working with the OAuth2 module and password grants, you need to specify a client ID and a client secret.
The service ID is not needed as it is implicit that the clients are authorized because they know the ID and secret associated with the service.

Make sure that the service definition file is in the format <string>-<id>.json
Mine is "dofbasen_oauth2_android-201801311512.json"

Here's my definition:

{
  "@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
  "clientId": "dofbasen_oauth2_android",
  "clientSecret": "XXX",
  "generateRefreshToken" : true,
  "jsonFormat" : true,
  "supported_grants" : ["password", "refresh_token"],
  "name" : "OAuth2 (Android)",
  "id" : 201801311512
}

When you send your request, you need to include both client_id AND client_secret, you are missing the client_secret from your request

I will however warn you, I have a bug at the moment which I've posted here:
https://groups.google.com/a/apereo.org/forum/#!topic/cas-user/ADjMnVevlJ0

Where the OAuth2 module gives you access tokens even if you dont specify the username and password, despite using grant_type = password
(It thinks you're using client_credentials)


Regards,
Anders Olsen

Leo Pintos

unread,
Feb 7, 2018, 8:51:04 AM2/7/18
to CAS Community
Hi Manfredo then I put the log with debug enabled:

Log:

2018-02-06 16:09:53,212 DEBUG [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-5) Grant type: [password]
2018-02-06 16:09:53,230 DEBUG [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-5) Received grant type [password] with client id [app_prueba]
2018-02-06 16:09:53,258 DEBUG [org.apereo.cas.support.oauth.validator.OAuth20Validator] (default task-5) [client_id]: [app_prueba]
2018-02-06 16:09:53,270 DEBUG [org.apereo.cas.support.oauth.validator.OAuth20Validator] (default task-5) Check registered service: [org.apereo.cas.support.oauth.services.OAuthRegisteredService@1e1c8e92[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@117fbfe8[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@7d996890[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@58f6a649,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@70b01af[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false,clientId=app_prueba,approvalPrompt=true,generateRefreshToken=false,jsonFormat=false,supportedResponseTypes=[],supportedGrantTypes=[]]]
2018-02-06 16:09:53,300 DEBUG [org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor] (default task-5) Locating OAuth registered service by client id [app_prueba]
2018-02-06 16:09:53,307 DEBUG [org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor] (default task-5) Located OAuth registered service [org.apereo.cas.support.oauth.services.OAuthRegisteredService@1e1c8e92[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@117fbfe8[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@7d996890[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@58f6a649,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@70b01af[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false,clientId=app_prueba,approvalPrompt=true,generateRefreshToken=false,jsonFormat=false,supportedResponseTypes=[],supportedGrantTypes=[]]]
2018-02-06 16:09:53,307 DEBUG [org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor] (default task-5) Creating matching service request based on [org.apereo.cas.support.oauth.services.OAuthRegisteredService@1e1c8e92[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@117fbfe8[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@7d996890[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@58f6a649,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@70b01af[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false,clientId=app_prueba,approvalPrompt=true,generateRefreshToken=false,jsonFormat=false,supportedResponseTypes=[],supportedGrantTypes=[]]]
2018-02-06 16:09:53,308 DEBUG [org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor] (default task-5) Using request headers to identify and build the target service url
2018-02-06 16:09:53,338 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Located service based on request header is [null]
2018-02-06 16:09:53,339 DEBUG [org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor] (default task-5) Authenticating the OAuth request indicated by [org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl@6e29cad0[id=app_prueba,originalUrl=app_prueba,artifactId=<null>,principal=<null>,loggedOutAlready=false,format=XML]]
2018-02-06 16:09:53,347 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Created final principal [USER001] after filtering attributes based on [org.apereo.cas.support.oauth.services.OAuthRegisteredService@1e1c8e92[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@117fbfe8[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@7d996890[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@58f6a649,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@70b01af[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false,clientId=app_prueba,approvalPrompt=true,generateRefreshToken=false,jsonFormat=false,supportedResponseTypes=[],supportedGrantTypes=[]]]
2018-02-06 16:09:53,348 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) OAuth [state] is [], and [nonce] is []
2018-02-06 16:09:53,348 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Added attribute [authenticationMethod] to the authentication
2018-02-06 16:09:53,348 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Added attribute [isFromNewLogin] to the authentication
2018-02-06 16:09:53,348 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Added attribute [longTermAuthenticationRequestTokenUsed] to the authentication
2018-02-06 16:09:53,348 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Added attribute [authenticationDate] to the authentication
2018-02-06 16:09:53,348 DEBUG [org.apereo.cas.support.oauth.authenticator.OAuth20CasAuthenticationBuilder] (default task-5) Added attribute [successfulAuthenticationHandlers] to the authentication
2018-02-06 16:09:53,388 WARN  [org.apereo.cas.services.RegisteredServiceAccessStrategyUtils] (default task-5) Unauthorized Service Access. Service [app_prueba] is not found in service registry.
2018-02-06 16:09:53,407 INFO  [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] (default task-5) Audit trail record BEGIN
=============================================================
WHO: USER001
WHAT: UNAUTHORIZED_SERVICE_EXCEPTION
ACTION: TICKET_GRANTING_TICKET_NOT_CREATED
APPLICATION: CAS
WHEN: Tue Feb 06 16:09:53 UYT 2018
CLIENT IP ADDRESS: 10.97.192.52
SERVER IP ADDRESS: 10.97.192.52
=============================================================



2018-02-06 16:09:53,408 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-5) Could not identify and extract access token request: org.apereo.cas.services.UnauthorizedServiceException: Unauthorized Service Access. Service [app_prueba] is not found in service registry.
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(RegisteredServiceAccessStrategyUtils.java:53)
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(RegisteredServiceAccessStrategyUtils.java:69)
        at org.apereo.cas.services.RegisteredServiceAccessStrategyUtils.ensurePrincipalAccessIsAllowedForService(RegisteredServiceAccessStrategyUtils.java:85)
        at org.apereo.cas.DefaultCentralAuthenticationService.createTicketGrantingTicket(DefaultCentralAuthenticationService.java:362)
        at org.apereo.cas.DefaultCentralAuthenticationService$$FastClassBySpringCGLIB$$b02e48f2.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:85)
        at org.apereo.inspektr.audit.AuditTrailManagementAspect.handleAuditTrail(AuditTrailManagementAspect.java:134)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:629)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:618)
        at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:282)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673)
        at org.apereo.cas.DefaultCentralAuthenticationService$$EnhancerBySpringCGLIB$$3ec04ecd.createTicketGrantingTicket(<generated>)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:282)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
        at com.sun.proxy.$Proxy165.createTicketGrantingTicket(Unknown Source)

        at org.apereo.cas.support.oauth.web.response.accesstoken.ext.AccessTokenPasswordGrantRequestExtractor.extract(AccessTokenPasswordGrantRequestExtractor.java:79)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.examineAndExtractAccessTokenGrantRequest(OAuth20AccessTokenEndpointController.java:189)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.handleRequest(OAuth20AccessTokenEndpointController.java:111)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController$$FastClassBySpringCGLIB$$db180f28.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
        at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673)
        at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController$$EnhancerBySpringCGLIB$$a4960b9.handleRequest(<generated>)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)

Leo Pintos

unread,
Feb 7, 2018, 8:54:07 AM2/7/18
to CAS Community
Hi Anders!

Thank you for your answer I will try with your advices and then I comment the results.

Regards

Leo Pintos

unread,
Feb 8, 2018, 9:05:59 AM2/8/18
to CAS Community
Hi Anders!


We made the configuration you told us and we got the next msg error

[org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-10) Grant type: [password]
[org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-10) Received grant type [password] with client id [app_prueba]
[org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] (default task-10) Access token request verification failed

Executing the command
"curl -X POST -k -i 'https://XXXXX/cas/oauth2.0/accessToken?grant_type=password&client_id=app_prueba&client_secret=clientSecret&username=XXXXX&password=XXXX&service=https://XXXXXXX'".

CAS version 5.1.X not support client credencials grand type.

Tks!
Leo



El miércoles, 7 de febrero de 2018, 6:21:02 (UTC-3), Anders Olsen escribió:
Reply all
Reply to author
Forward
0 new messages