Not receiving user attributes from CAS server

[mahmoudaudu]

Hello,

I have been attempting to follow your instructions to fit it to work with an MVC Application (.net core 6) and i am having problems. I got the set up for Progam.cs (I think, see my set up on stack overflow SEE CODE

I also create a AccountController (also in stackoverflow code) and it works in development (local deploy) but fails in remote.
I only have a line of code

return this.Challenge(new AuthenticationProperties { RedirectUri = "/" }, "CAS");

but i feel like i am missing adding the identity and Claims and sign in, can you help me figure out what I am doing wrong for the remote (NON DEVELOPMENT) section

thanks

[akunzai]

Hi @mahmoudaudu,

First of all, this package is acted as a CAS client, not a CAS server

Please make sure you have a running CAS server configured to allowed your MVC application (eg: https://localhost:5001) to sign in.

You can check out this sample and change the Authentication.CAS.ServerUrlBase to fit your CAS server URL in appsettings.json.

If the sample not working as expected, please provide the exception message or captured screenshot.

Hope this information can help.

[mahmoudaudu]

Good day

Thank you for the quick response, let me clarify further

my app points to our CAS server, my app or machine is NOT the CAS server.
I did set the Authentication.CAS.ServerUrlBase to point to our CAS server URL in appsettings.json

It opens the CAS Page and I log in then it redirects to the /Account/ExternalLoginFailure page

and as I mentioned above the only command I call is

return this.Challenge(new AuthenticationProperties { RedirectUri = "/" }, "CAS");

I think this is wrong or I am missing pieces (please let me know if you want to see what my AccountController.cs looks like)

anyway this is my errror stack

Category: Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware
EventId: 1
SpanId: f00d595e03e64ae5
TraceId: 2bc813b873acac0dac174ba9e7cf3c3f
ParentId: 0000000000000000
RequestId: 80004898-0401-f500-b63f-84710c7967bb
RequestPath: /OneRecordIssue6/Account/Login

An unhandled exception has occurred while executing the request.

Exception:
System.ArgumentNullException: Value cannot be null. (Parameter 'value')
at System.Security.Claims.Claim..ctor(String type, String value, String valueType, String issuer, String originalIssuer, ClaimsIdentity subject, String propertyKey, String propertyValue)
at System.Security.Claims.Claim..ctor(String type, String value)
at OneRecordIssue6.Controllers.AccountController.Login() in E:\WORK\Github\OneRecordIssue2\OneRecordIssue6\Controllers\AccountController.cs:line 40
at lambda_method1(Closure , Object , Object[] )
at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync()
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
at Microsoft.AspNetCore.Routing.EndpointMiddleware.g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

[akunzai]

You need to debug at your AccountController.cs line 40 to find out why the new Claim value is null.

[akunzai]

Hi @mahmoudaudu,

Please use the sample project I provided for discussion, I have no responsibility to debug your code.

[mahmoudaudu]

Oh I forgot to ask,

I noticed in the program.cs we set the claim(in the .AddCas section, is this still carried over during the login and accountcontroller stage?

thank you so much for this

[akunzai]

Hi @mahmoudaudu,

The ASP.NET Core Identity(claims) should be configured by the assertion in the OnCreatingTicket event hook after the authentication challenge and successfully signed-in from your CAS server.

There is no need to configure the claims in AccountController.

[mahmoudaudu]

thank you for clarifying,

now i guess my issue is in the Accountcontroller. The isdev part works, but the remote one fails, is it because i am not executing a this.HttpContext.SignInAsync?

[AllowAnonymous]
 public class AccountController : Controller
 {
     IConfiguration configuration;

     public AccountController(IConfiguration configuration)
     {
         this.configuration = configuration;
     }

     public IActionResult Login()
     {
         string isDev = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");
         if (isDev == "Development")
         {
             var simulatedUser = this.configuration.GetSection("Settings:simulatedUser").Value.ToString();
             var identity = new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, simulatedUser) }, CookieAuthenticationDefaults.AuthenticationScheme);
             var principal = new ClaimsPrincipal(identity);
             var authProperties = new AuthenticationProperties { ExpiresUtc = DateTimeOffset.UtcNow.AddSeconds(5), IsPersistent = false, RedirectUri = "/" };
             this.HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal, authProperties);
             return this.RedirectToAction("Index", "Home");
         }
         else
         {
             return this.Challenge(new AuthenticationProperties { RedirectUri = "/" }, "CAS");
         }
     }

     public IActionResult ExternalLoginFailureModel()
     {
         this.Response.StatusCode = 500;
         return this.RedirectToAction("Error", "Home");
     }
 }

[mahmoudaudu]

i got a new error

The app is hitting the auth log-in screen but when we enter creds and click sign in, it redirects to a generic error page and writes something unhelpful in the event log.

Response status code does not indicate success: 500 ().

Exception:
System.Net.Http.HttpRequestException: Response status code does not indicate success: 500 ().
at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
at GSS.Authentication.CAS.Validation.CasServiceTicketValidator.ValidateAsync(String ticket, String service, CancellationToken cancellationToken)
at GSS.Authentication.CAS.AspNetCore.CasAuthenticationHandler1.HandleRemoteAuthenticateAsync() at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler1.HandleRequestAsync()

[akunzai]

The dev part in your code is configure the ClaimsIdentity to generate AspNet cookies, it never Single Sign-on through your CAS server.

The exception means your CAS server response HTTP 500 error when validating service ticket.

you need to check the logs in your CAS server.

[mahmoudaudu]

we solved the problem, the issue was our protocol was 2 and we had it set to 3 in our app

[mahmoudaudu]

Thank you so much for your help we solved the problem, the issue was our protocol was 2 and we had it set to 3 in our app