Cas 如何包括经过身份验证的用户';她在JWT中的角色?
我已将CAS配置为OAuth2服务器。登录成功后返回JWT,但JWT中的角色字段始终为空,如:Cas 如何包括经过身份验证的用户';她在JWT中的角色?,cas,apereo,Cas,Apereo,我已将CAS配置为OAuth2服务器。登录成功后返回JWT,但JWT中的角色字段始终为空,如: { "sub": "dg", ... "roles": [], "nonce": "", "client_id": "first-client", "credentialType": "UsernamePasswordCredential", ... } 当我登录时,如何在JWT中获取和放置经过身份验证的用户角色 这是我的示例服务注册表 { "@class" : "org.apereo.cas
{
"sub": "dg",
...
"roles": [],
"nonce": "",
"client_id": "first-client",
"credentialType": "UsernamePasswordCredential",
...
}
当我登录时,如何在JWT中获取和放置经过身份验证的用户角色
这是我的示例服务注册表
{
"@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
"serviceId" : "http://localhost:8085/.*",
"name" : "CAS Spring Secured App",
"description": "This is a Spring App that usses the CAS Server for its authentication",
"id" : 1,
"evaluationOrder" : 1,
"bypassApprovalPrompt": true,
"jwtAccessToken": true,
"clientId": "first-client",
"clientSecret": "noonewilleverguess",
"supportedGrantTypes": [ "java.util.HashSet", [ "authorization_code" ] ],
"supportedResponseTypes": [ "java.util.HashSet", [ "code" ] ]
}
谢谢你的帮助。我找到了解决办法。从CAS博客()中 现在,CAS无法直接检索属性作为身份验证的一部分,因此我们需要设置一个单独的属性存储库实例,一旦用户完全通过身份验证,CAS将联系该实例 因此,我们需要使用属性存储库(它有许多类型,如ldap、jdbc、存根…) 我已经为属性存储库配置了jdbc。(postgresql作为数据库) 首先,您需要向build.gradle添加两个依赖项
compile "org.apereo.cas:cas-server-support-jdbc:${casServerVersion}"
compile "org.apereo.cas:cas-server-support-jdbc-drivers:${casServerVersion}"
然后,创建用于获取属性的数据库。例如,命名为my_角色
id (serial) | user_name (varchar(50)) | role_name (text[])
----------------------------------------------------------
1 | dg | {'ROLE_READ', 'ROLE_WRITE'}
然后,像这样配置属性存储库
cas.authn.attribute-repository.jdbc[0].sql=SELECT * FROM my_roles WHERE {0}
cas.authn.attribute-repository.jdbc[0].username=user_name
cas.authn.attribute-repository.jdbc[0].user=postgres
cas.authn.attribute-repository.jdbc[0].password=postgres
cas.authn.attribute-repository.jdbc[0].url=jdbc:postgresql://localhost:5432/customer
cas.authn.attribute-repository.jdbc[0].driverClass=org.postgresql.Driver
cas.authn.attribute-repository.jdbc[0].dialect=org.hibernate.dialect.PostgreSQL95Dialect
最后,别忘了将发布策略添加到服务注册表中
{
...
"attributeReleasePolicy" : {
"@class" : "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
"allowedAttributes" : [ "java.util.ArrayList", [ "role_name" ] ]
}
}
因此,结果如下
{
"sub": "dg",
...
"role_name":
[
"ROLE_WRITE",
"ROLE_READ"
],
"aud": "http://localhost:8085/login/oauth2/code/login-client",
"grant_type": "AUTHORIZATION_CODE",
...
}