[GitHub] [guacamole-client] lchanouha commented on a change in pull request #563: GUACAMOLE-793: validateTicket() returns the CASAuthenticatedUser instance

[GitBox <gi...@apache.org>]

lchanouha commented on a change in pull request #563:
URL: https://github.com/apache/guacamole-client/pull/563#discussion_r534404101



##########
File path: extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/ticket/TicketValidationService.java
##########
@@ -122,16 +134,44 @@
             }
             
             // Convert remaining attributes that have values to Strings
+            String groupAttribute = confService.getGroupAttribute();
+            // Use cas-member-attribute to retrieve and set group memberships
+            String groupDnFormat = confService.getGroupDnFormat();
+            String groupTemplate = "";
+            if (groupDnFormat != null) {
+                // if CAS is backended to LDAP, groups come in as RFC4514 DN
+                // syntax.  If cas-group-dn-format is set, this strips an
+                // entry such as "CN=Foo,OU=Bar,DC=example,DC=com" to "Foo"
+                groupTemplate = groupDnFormat.replace("%s","([A-Za-z0-9_\\(\\)\\-\\.\\s+]+)");
+                // the underlying parser aggregates all instances of the same
+                // attribute, so we need to be able to parse them out
+                groupTemplate=groupTemplate+",*\\s*";
+            }
+            else {
+                groupTemplate = "([A-Za-z0-9_\\(\\)\\-\\.\\s+]+,*\\s*)";
+            }
+            Pattern pattern = Pattern.compile(groupTemplate);
+
             for (Entry <String, Object> attr : ticketAttrs.entrySet()) {
                 String tokenName = TokenName.canonicalize(attr.getKey(),
                         CAS_ATTRIBUTE_TOKEN_PREFIX);
                 Object value = attr.getValue();
-                if (value != null)
-                    tokens.put(tokenName, value.toString());
+                if (value != null) {
+                    String attrValue = value.toString();
+                    tokens.put(tokenName, attrValue);
+                    if (attr.getKey().equals(groupAttribute)) {
+                        Matcher matcher =
+                            pattern.matcher(attrValue.substring(1,attrValue.length()-1));

Review comment:
       My cas (apereo 6.2) is returning groups names as short names, not names
   i ended with group "employee," with the comma included. I added replace(",","") to get it working
   
   The toString line 159 seems to be the source of the problem.
   
   Here is an example on how to do it when multivalued:
   ```
            if (entry.getValue() instanceof Collection) {
                   for (final Object value : (Collection) entry.getValue()) {
                       attributeValues.add(new StringAttributeValue(value.toString()));
                   }
               } else {
                   attributeValues.add(new StringAttributeValue(entry.getValue().toString()));
               }
   ```
   Taken from here: https://github.com/Unicon/shib-cas-authn3/blob/a8f296b1fd54e940d2b0cd5f4a5f6f5ddaa50bc0/src/main/java/net/unicon/idp/externalauth/AuthenticatedNameTranslator.java#L79




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org