Ken Hopkins

unread,

Aug 3, 2021, 3:57:30 PM8/3/21

to CAS Community

I am using the oauth2 client-credentials grant type, and am having trouble figuring out how to add attributes into the generated JWT.

My service definition is:

[

OAuthRegisteredService(
    super=AbstractRegisteredService(
      serviceId=abcdef,
      name=API Test,
      theme=null,
      informationUrl=null,
      privacyUrl=null,
      responseType=null,
      id=-8936606407628949180,
      description=null,
      expirationPolicy=DefaultRegisteredServiceExpirationPolicy(
        deleteWhenExpired=false,
        notifyWhenDeleted=false,
        notifyWhenExpired=false,
        expirationDate=null
      ),
      acceptableUsagePolicy=DefaultRegisteredServiceAcceptableUsagePolicy(
        enabled=true,
        messageCode=null,
        text=null
      ),
      proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@1,
      proxyTicketExpirationPolicy=null,
      proxyGrantingTicketExpirationPolicy=null,
      serviceTicketExpirationPolicy=null,
      singleSignOnParticipationPolicy=null,
      evaluationOrder=0,
      usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@87297e2,
      logoutType=BACK_CHANNEL,
      environments=[],
      attributeReleasePolicy=ReturnAllowedAttributeReleasePolicy(
        super=AbstractRegisteredServiceAttributeReleasePolicy(
          attributeFilter=null,
          principalAttributesRepository=DefaultPrincipalAttributesRepository(),
          consentPolicy=DefaultRegisteredServiceConsentPolicy(
            enabled=true,
            excludedAttributes=null,
            includeOnlyAttributes=null,
            order=0
          ),
          authorizedToReleaseCredentialPassword=false,
          authorizedToReleaseProxyGrantingTicket=false,
          excludeDefaultAttributes=false,
          authorizedToReleaseAuthenticationAttributes=true,
          principalIdAttribute=null,
          order=0
        ),
        allowedAttributes=[myName]
      ),
      multifactorPolicy=DefaultRegisteredServiceMultifactorPolicy(
        multifactorAuthenticationProviders=[],
        failureMode=UNDEFINED,
        principalAttributeNameTrigger=null,
        principalAttributeValueToMatch=null,
        bypassEnabled=false,
        forceExecution=false,
        bypassTrustedDeviceEnabled=false,
        bypassPrincipalAttributeName=null,
        bypassPrincipalAttributeValue=null,
        script=null
      ),
      logo=null,
      logoutUrl=null,
      redirectUrl=null,
      accessStrategy=DefaultRegisteredServiceAccessStrategy(
        order=0,
        enabled=true,
        ssoEnabled=true,
        unauthorizedRedirectUrl=null,
        delegatedAuthenticationPolicy=DefaultRegisteredServiceDelegatedAuthenticationPolicy(
          allowedProviders=[],
          permitUndefined=true,
          exclusive=false
        ),
        requireAllAttributes=true,
        requiredAttributes={},
        rejectedAttributes={},
        caseInsensitive=false
      ),
      publicKey=null,
      authenticationPolicy=DefaultRegisteredServiceAuthenticationPolicy(
        requiredAuthenticationHandlers=[],
        criteria=AnyAuthenticationHandlerRegisteredServiceAuthenticationPolicyCriteria(
          tryAll=false
        )
      ),
      properties={
        permissions=DefaultRegisteredServiceProperty(values=[1373037743]),
        claims=DefaultRegisteredServiceProperty(values=[1366926713]),
        accessTokenAsJwtSigningKey=DefaultRegisteredServiceProperty(
          values=[classpath:/etc/cas/config/cas-private.key]
        ),
        accessTokenAsJwtSigningEnabled=DefaultRegisteredServiceProperty(
          values=[true]
        ),
        myName=DefaultRegisteredServiceProperty(values=[583852201])
      },
      contacts=[]
    ),
    clientSecret=def,
    clientId=abc,
    bypassApprovalPrompt=false,
    generateRefreshToken=false,
    renewRefreshToken=false,
    jwtAccessToken=true,
    codeExpirationPolicy=null,
    accessTokenExpirationPolicy=null,
    refreshTokenExpirationPolicy=null,
    deviceTokenExpirationPolicy=null,
    supportedGrantTypes=[client_credentials],
    supportedResponseTypes=[]
)
]
The jwt token that gets created is:

{
"sub": "abc",
"oauthClientId": "abc",
"roles":[],
"iss": "https://localhost:7001/cas",
"nonce": "",
"client_id": "abc",
"aud": "abc",
"grant_type": "CLIENT_CREDENTIALS",
"permissions":[],
"scope":[],
"claims":[],
"scopes":[],
"state": "",
"exp": 1628045011,
"iat": 1628016211,
"jti": "AT-2-vjOSaRnTRYfARo-fX-ZVsDB-dLVLjBRz"
}

As a test I'm trying to get a property myName to show up in the jwt token. I'm ultimately trying to populate the permissions property.

When using other grant types such as password, I'm able add custom attributes to the jwt token just fine. I'm using REST authentication, so I can just return custom attributes in the response to CAS's login call. However, since CAS doesn't make a REST authentication call for client_credentials, that technique doesn't help here. In this case, I'm using a RESTful Service Registry (https://apereo.github.io/cas/6.3.x/services/REST-Service-Management.html) in case that's relevant.

Thanks for any ideas or insights,

Ken

Ray Bon

unread,

Aug 3, 2021, 4:26:59 PM8/3/21

to cas-...@apereo.org

Ken,

Try this logger to see what cas is collecting as attributes:

<!-- DEBUG Found principal attributes [...] for [username]

Attribute policy [???] allows release of [...] for [username]

Final collection of attributes allowed are: [...] -->

Ray

On Tue, 2021-08-03 at 12:57 -0700, 'Ken Hopkins' via CAS Community wrote:

Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Hopkins, Kenneth E

unread,

Aug 4, 2021, 9:50:25 AM8/4/21

to cas-...@apereo.org

Thanks for the reply Ray. I did have TRACE level debugging on, so I was getting those log messages. However, I hadn't really paid attention to them.

2021-08-04 09:44:54,124 DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Initiating attributes release phase for principal [abc] accessing service [AbstractWebApplicationService(id=abc, originalUrl=abc, artifactId=null, principal=null, source=null, loggedOutAlready=false, format=XML, attributes={})] defined by registered service [abcdef]...>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Locating principal attributes for [abc]>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Loading global principal attribute repository with caching policies...>

2021-08-04 09:44:54,124 DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Using principal attribute repository [DefaultPrincipalAttributesRepository()] to retrieve attributes>

2021-08-04 09:44:54,124 DEBUG [org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository] - <Using [abc], no caching takes place for [DefaultPrincipalAttributesRepository] to add attributes.>

2021-08-04 09:44:54,124 DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Found principal attributes [{oauthClientId=[abc]}] for [abc]>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Located application context. Retrieving attribute definition store and attribute definitions...>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <No attribute definitions are defined in the attribute definition store>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Resolved principal attributes [{oauthClientId=[abc]}] for [abc] from attribute definition store>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Calling attribute policy [ReturnAllAttributeReleasePolicy] to process attributes for [abc]>

2021-08-04 09:44:54,124 DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Attribute policy [ReturnAllAttributeReleasePolicy] allows release of [{oauthClientId=[abc]}] for [abc]>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Attempting to merge policy attributes and default attributes>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Checking default attribute policy attributes>

2021-08-04 09:44:54,124 TRACE [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Located application context. Retrievin2021-08-04 09:44:54,124 DEBUG [org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] - <Initiating attributes release phase for principal [abc] accessing service [AbstractWebApplicationService(id=abc, originalUrl=abc, artifactId=null, principal=null, source=null, loggedOutAlready=false, format=XML, attributes={})] defined by registered service [abcdef]...>