How to Add OAuth Clients to CAS Server?

Alvaro S.

unread,

Feb 9, 2017, 5:32:19 AM2/9/17

to CAS Community

Hi, I'm trying to add som clients to my config, the documentation states this:

Every OAuth client must be defined as a CAS service (notice the new clientId and clientSecret properties, specific to OAuth)

And shows this json

{
  "@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
  "clientId": "clientid",
  "clientSecret": "clientSecret",
  "bypassApprovalPrompt": false,
  "serviceId" : "^(https|imaps)://hello.*",
  "name" : "HTTPS and IMAPS",
  "id" : 10000001

}

But where I have to put this??

I'm using a maven overlay

mrcasa bengaluru

unread,

Feb 9, 2017, 7:01:55 AM2/9/17

to cas-...@apereo.org

Add the json to /etc/cas/config

Each OAuth service must have a json of its own. Update the json with service specific details

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c8ec3266-1f7a-4782-878b-c133569898a9%40apereo.org.

Alvaro

unread,

Feb 9, 2017, 7:03:38 AM2/9/17

to cas-...@apereo.org

Thanks. That must be on the documentation because right now is missing

The name does not matter right?

Thanks again.

On Thu, Feb 9, 2017 at 1:01 PM, mrcasa bengaluru <mrca...@gmail.com> wrote:

Add the json to /etc/cas/config

Each OAuth service must have a json of its own. Update the json with service specific details

On Thu, Feb 9, 2017 at 4:02 PM, Alvaro S. <dragon...@gmail.com> wrote:

Hi, I'm trying to add som clients to my config, the documentation states this:

Every OAuth client must be defined as a CAS service (notice the new clientId and clientSecret properties, specific to OAuth)

And shows this json

{ "@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService", "clientId": "clientid", "clientSecret": "clientSecret", "bypassApprovalPrompt": false, "serviceId" : "^(https|imaps)://hello.*", "name" : "HTTPS and IMAPS", "id" : 10000001
}

But where I have to put this??

I'm using a maven overlay

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c8ec3266-1f7a-4782-878b-c133569898a9%40apereo.org.

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---

You received this message because you are subscribed to a topic in the Google Groups "CAS Community" group.
To unsubscribe from this topic, visit https://groups.google.com/a/apereo.org/d/topic/cas-user/0Eg2rvGOEOU/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CALpZ%2BOQTbzMv7aBn1Ou7mY6dFA31tRsG1OfO27HRk1NyFs5TcQ%40mail.gmail.com.

mrcasa bengaluru

unread,

Feb 9, 2017, 10:14:02 AM2/9/17

to cas-...@apereo.org

You can control the location of service registry json files by using this propery in cas.properties

cas.serviceRegistry.config.location=file:/etc/cas/config

Here is the naming recommendation deom the docs -

The naming convention for new JSON files is recommended to be the following:

JSON fileName = serviceName + "-" + serviceNumericId + ".json"

To unsubscribe from this group and all its topics, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CALpZ%2BOQTbzMv7aBn1Ou7mY6dFA31tRsG1OfO27HRk1NyFs5TcQ%40mail.gmail.com.

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAA%2Bkr1Y%3DqS73TVyP8krdPRtS0F8-ZsWpwO43Fas1Ci8aZhQHdg%40mail.gmail.com.

Alvaro

unread,

Feb 10, 2017, 5:43:39 AM2/10/17

to cas-...@apereo.org

Where can I find more information about services and his fields? Because in some examples puts:

"serviceId" : "^(https|imaps)://hello.*",

But I don't know if that is a regex, or a bad example I don't understand it well.

The problem that I'm facing is that I'm getting this error:

Unauthorized Service Access. Service [http://localhost:9999/client/login] is not found in service registry.

This is my json

{

"@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",

"clientId": "acme",

"clientSecret": "acmesecret",

"bypassApprovalPrompt": false,

"serviceId" : "http://localhost:9999/client/login",

"name" : "HTTPS and IMAPS",

"id" : 1

}

Thanks

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAA%2Bkr1Y%3DqS73TVyP8krdPRtS0F8-ZsWpwO43Fas1Ci8aZhQHdg%40mail.gmail.com.

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to a topic in the Google Groups "CAS Community" group.
To unsubscribe from this topic, visit https://groups.google.com/a/apereo.org/d/topic/cas-user/0Eg2rvGOEOU/unsubscribe.

To unsubscribe from this group and all its topics, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CALpZ%2BOQFH8K2t9mQ_nrOgnktuubA_0G%2Br9Qniwp8y6n0AykPJw%40mail.gmail.com.

mrcasa bengaluru

unread,

Feb 10, 2017, 10:21:06 AM2/10/17

to cas-...@apereo.org

Try this:

"serviceId" : "^(https?|http?)://.*",

To unsubscribe from this group and all its topics, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CALpZ%2BOQFH8K2t9mQ_nrOgnktuubA_0G%2Br9Qniwp8y6n0AykPJw%40mail.gmail.com.

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAA%2Bkr1bB%2BHNac-Hjv%3Dpr9qvPTtN8LqRkVZLHS7cgP3kn%2BmfCZw%40mail.gmail.com.

Ray Bon

unread,

Feb 10, 2017, 12:38:30 PM2/10/17

to cas-...@apereo.org

Alvaro,

It is regex and a good example.
In your json example, the serviceId is specific and must match exactly. If your service has parameters, http://localhost:9999/client/login?blah=, or it is followed by a trailing slash, http://localhost:9999/client/login/, it will not match.
You can make your service id more generic
"serviceId" : "http://localhost:9999/client/login.*"

Ray

-- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAA%2Bkr1bB%2BHNac-Hjv%3Dpr9qvPTtN8LqRkVZLHS7cgP3kn%2BmfCZw%40mail.gmail.com.

-- 
Ray Bon
Programmer Analyst
Development Services, University Systems
2507218831 | CLE C023 | rb...@uvic.ca

Alvaro

unread,

Feb 13, 2017, 5:47:24 AM2/13/17

to cas-...@apereo.org

Hi, I've tried with some regex but no one worked.

I see that ^(https|imaps)://.* doesn't will work well because you need to escape the doble slash //, but even with the regex

^(https|imaps):.* doesn't work either

When the server boots, the console shows this messages:

But when I tried to log in through my application, I'm getting this error:

The callback URI is this:

https://localhost:8443/cas/oauth2.0/callbackAuthorize?client_name=CasOAuthClient&client_id=acme&redirect_uri=http://localhost:9999/client/login&ticket=ST-1-nIwbwuy5efa1W6Teqyfj-ev007

My Service.json

{

"@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",

"clientId": "acme",

"clientSecret": "acmesecret",

"bypassApprovalPrompt": false,

"serviceId" : "^(https?|http?):.*",

"name" : "HTTPS and IMAPS",

"id" : 1

}

And the error

2017-02-13 11:31:40,699 DEBUG [org.apereo.cas.web.FlowExecutionExceptionResolver] - <Ignoring the received exception due to a type mismatch>

org.pac4j.core.exception.TechnicalException: cannot validate CAS ticket: ST-1-nIwbwuy5efa1W6Teqyfj-ev007

at org.pac4j.cas.credentials.authenticator.CasAuthenticator.validate(CasAuthenticator.java:76) ~[pac4j-cas-1.9.4.jar!/:?]

at org.pac4j.cas.credentials.authenticator.CasAuthenticator.validate(CasAuthenticator.java:26) ~[pac4j-cas-1.9.4.jar!/:?]

at org.pac4j.core.client.IndirectClientV2.retrieveCredentials(IndirectClientV2.java:49) ~[pac4j-core-1.9.4.jar!/:?]

at org.pac4j.core.client.IndirectClient.getCredentials(IndirectClient.java:105) ~[pac4j-core-1.9.4.jar!/:?]

at org.pac4j.core.engine.DefaultCallbackLogic.perform(DefaultCallbackLogic.java:77) ~[pac4j-core-1.9.4.jar!/:?]

at org.pac4j.springframework.web.CallbackController.callback(CallbackController.java:53) ~[spring-webmvc-pac4j-1.1.4.jar!/:?]

at org.apereo.cas.support.oauth.web.OAuth20CallbackAuthorizeController.handleRequestInternal(OAuth20CallbackAuthorizeController.java:45) ~[cas-server-support-oauth-5.0.3-SNAPSHOT.jar!/:5.0.3-SNAPSHOT]

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_45]

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_45]

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_45]

at java.lang.reflect.Method.invoke(Method.java:497) ~[?:1.8.0_45]

at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:220) ~[spring-web-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:134) ~[spring-web-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:116) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at javax.servlet.http.HttpServlet.service(HttpServlet.java:622) ~[tomcat-embed-core-8.5.9.jar!/:8.5.9]

at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) ~[spring-webmvc-4.3.4.RELEASE.jar!/:4.3.4.RELEASE]

at javax.servlet.http.HttpServlet.service(HttpServlet.java:729) ~[tomcat-embed-core-8.5.9.jar!/:8.5.9]

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230) ~[tomcat-embed-core-8.5.9.jar!/:8.5.9]