Question

I need send certain attributes(say, human readable user name) from server to client after a successful authentication. Server part was done. Now attribute was sent to client. From log, I can see:

2010-03-28 23:48:56,669 DEBUG
Cas20ServiceTicketValidator:185 –
Server response: http://www.yale.edu/tp/cas’>

[e-mail]

        <cas:proxyGrantingTicket>PGTIOU-1-QZgcN61oAZcunsC9aKxj-cas</cas:proxyGrantingTicket>



        <cas:attributes>

                <cas:FullName>Test account 1</cas:FullName>

        </cas:attributes>

</cas:authenticationSuccess> </cas:serviceResponse>

Yet, I don’t know how to access the attribute in client(I am using Spring security 2.0.5).

In authenticationProvider, a userDetailsService is configured to read db for authenticated principal.

<bean id="casAuthenticationProvider" class="org.springframework.security.providers.cas.CasAuthenticationProvider">
    <sec:custom-authentication-provider />
    <property name="userDetailsService" ref="clerkManager"/>
    <!-- other stuff goes here -->
</bean>

Now in my controller, I can easily do this:

 Clerk currentClerk = (Clerk)SecurityContextHolder.getContext().getAuthentication().getPrincipal();

Ideally, I can fill the attribute to this Clerk object as another property in some way. How to do this?

Or what is recommended approach to share attributes across all apps under CAS’s centralized nature?

Answer 1

For SpringSecurity – you need to upgrade to 3.x to leverage CAS attributes via the built-in support, see: GrantedAuthorityFromAssertionAttributesUserDetailsService.java

It doesn’t look like SpringSecurity 2.x populates based on CAS attributes – if you look at:

CasAuthenticationProvider.java at getUserDetailsService():

/**
 * Template method for retrieving the UserDetails based on the assertion.  Default is to call configured userDetailsService and pass the username.  Deployers
 * can override this method and retrieve the user based on any criteria they desire.
 * 
 * @param assertion The CAS Assertion.
 * @returns the UserDetails.
 */
protected UserDetails loadUserByAssertion(final Assertion assertion) {
    return this.userDetailsService.loadUserByUsername(assertion.getPrincipal().getName());
}

You could of course override this with a UserDetails implementation, if you have to stay on 2.x for some reason.