OIDC issue since 5.3.2

86 views

Skip to first unread message

Gregory G

unread,

Aug 23, 2018, 6:03:42 PM8/23/18

to CAS Community

Hello,

Since i ve migrated to CAS 5.3.2 from 5.2.4, i'm not unable to do an OpenID Connect

With IDEA dev env, connection passes but on prod environment, it is broken

My cas properties for OIDC

#OIDC

cas.authn.oidc.jwksFile=file:/home/cas/cas_files/keystore.jwks

cas.authn.oidc.claimsMap.preferred_username=sAMAccountName

cas.authn.oidc.claimsMap.name=cn

cas.authn.oidc.claimsMap.id=id

cas.authn.oidc.claimsMap.email=mail

cas.authn.oidc.scopes=openid,profile,email,address,phone,offline_access,testScope

cas.authn.oidc.userDefinedScopes.testScope=preferred_username,name,email,mail,uid,id

And the log of error

2018-08-23 23:58:51,365 ERROR [org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/cas].[dispatcherServlet]] - <Servlet.service() for servlet [dispatcherServlet] in context with path [/cas] threw exception [Request processing failed; nested exception is java.lang.IllegalStateException: Cannot find service ticket issues to https://cas.example.com/cas/oauth2.0/callbackAuthorize.* as part of the authentication context] with root cause>

java.lang.IllegalStateException: Cannot find service ticket issues to https://cas.example.com/cas/oauth2.0/callbackAuthorize.* as part of the authentication context

at com.google.common.base.Preconditions.checkState(Preconditions.java:504) ~[guava-25.0-jre.jar!/:?]

at org.apereo.cas.oidc.token.OidcIdTokenGeneratorService.getOAuthServiceTicket(OidcIdTokenGeneratorService.java:178) ~[cas-server-support-oidc-5.3.2.jar!/:5.3.2]

at org.apereo.cas.oidc.token.OidcIdTokenGeneratorService.produceIdTokenClaims(OidcIdTokenGeneratorService.java:134) ~[cas-server-support-oidc-5.3.2.jar!/:5.3.2]

at org.apereo.cas.oidc.token.OidcIdTokenGeneratorService.generate(OidcIdTokenGeneratorService.java:103) ~[cas-server-support-oidc-5.3.2.jar!/:5.3.2]

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_144]

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_144]

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]

at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_144]

at org.springframework.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:216) ~[spring-core-4.3.18.RELEASE.jar!/:4.3.18.RELEASE]

at org.springframework.cloud.context.scope.GenericScope$LockedScopedProxyFactoryBean.invoke(GenericScope.java:470) ~[spring-cloud-context-1.3.0.RELEASE.jar!/:1.3.0.RELEASE]

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) ~[spring-aop-4.3.18.RELEASE.jar!/:4.3.18.RELEASE]

at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:671) ~[spring-aop-4.3.18.RELEASE.jar!/:4.3.18.RELEASE]

at org.apereo.cas.oidc.token.OidcIdTokenGeneratorService$$EnhancerBySpringCGLIB$$8505662.generate(<generated>) ~[cas-server-support-oidc-5.3.2.jar!/:5.3.2]

at org.apereo.cas.oidc.web.OidcAccessTokenResponseGenerator.generateJsonInternal(OidcAccessTokenResponseGenerator.java:44) ~[cas-server-support-oidc-5.3.2.jar!/:5.3.2]

at org.apereo.cas.support.oauth.web.response.accesstoken.OAuth20AccessTokenResponseGenerator.generate(OAuth20AccessTokenResponseGenerator.java:64) ~[cas-server-support-oauth-5.3.2.jar!/:5.3.2]

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_144]

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_144]

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]

at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_144]

at org.springframework.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:216) ~[spring-core-4.3.18.RELEASE.jar!/:4.3.18.RELEASE]

at org.springframework.cloud.context.scope.GenericScope$LockedScopedProxyFactoryBean.invoke(GenericScope.java:470) ~[spring-cloud-context-1.3.0.RELEASE.jar!/:1.3.0.RELEASE]

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) ~[spring-aop-4.3.18.RELEASE.jar!/:4.3.18.RELEASE]

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) ~[spring-aop-4.3.18.RELEASE.jar!/:4.3.18.RELEASE]

at com.sun.proxy.$Proxy203.generate(Unknown Source) ~[?:?]

at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.generateAccessTokenResponse(OAuth20AccessTokenEndpointController.java:147) ~[cas-server-support-oauth-5.3.2.jar!/:5.3.2]

at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.handleRequest(OAuth20AccessTokenEndpointController.java:121) ~[cas-server-support-oauth-5.3.2.jar!/:5.3.2]

at org.apereo.cas.oidc.web.controllers.OidcAccessTokenEndpointController.handleRequest(OidcAccessTokenEndpointController.java:69) ~[cas-server-support-oidc-5.3.2.jar!/:5.3.2]