Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Warnings when user is signing in using OIDC #4

Open
matsbov opened this issue Apr 4, 2024 · 0 comments
Open

Warnings when user is signing in using OIDC #4

matsbov opened this issue Apr 4, 2024 · 0 comments
Labels
invalid This doesn't seem right

Comments

@matsbov
Copy link

matsbov commented Apr 4, 2024

Casserver log:

2024-03-28 12:28:50,358 WARN [org.apereo.cas.authentication.attribute.PrincipalAttributeRepositoryFetcher] - <No person records were fetched from attribute repositories for [{credentialClass=[OAuth20ClientIdClientSecretCredential], credentialId=[Ux7iQhANVFkvaGhxgL0J2h6wVyhDvyQ9N98F], username=Ux7iQhANVFkvaGhxgL0J2h6wVyhDvyQ9N98F}]>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] - <None of the principal resolvers in the chain were able to produce a principal>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [email] mapped to attribute [email], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [email_verified] mapped to attribute [activated], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [name] mapped to attribute [displayName], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [family_name] mapped to attribute [sn], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [given_name] mapped to attribute [givenName], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [preferred_username] mapped to attribute [username], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,358 WARN [org.apereo.cas.oidc.claims.BaseOidcScopeAttributeReleasePolicy] - <Located claim [updated_at] mapped to attribute [lastUpdated], yet resolved attributes [{}] do not contain this attribute>
2024-03-28 12:28:50,425 WARN [org.apereo.cas.oidc.profile.OidcProfileScopeToAttributesFilter] - <Request does not indicate a scope [[ala, roles]] that can identify an OpenID Connect request. This is a REQUIRED scope that MUST be present in the request. Given its absence, CAS will not process any attribute claims and will return the authenticated principal as is.>
2024-03-28 12:28:50,430 WARN [org.apereo.cas.oidc.token.OidcIdTokenGeneratorService] - <Individual claims requested by OpenID scopes are forced to be included in the ID token. This is a violation of the OpenID Connect specification and a workaround via dedicated CAS configuration. Claims should be requested from the userinfo/profile endpoints in exchange for an access token.>
2024-03-28 12:28:50,431 WARN [org.apereo.cas.oidc.token.OidcIdTokenGeneratorService] - <Claim [oauthClientId] is not defined as a supported claim among [[sub, name, preferred_username, family_name, given_name, profile, locale, updated_at, email, email_verified, organisation, role, authority, city, state, country, userid]]. Skipping...>
2024-03-28 12:28:50,624 WARN [org.apereo.cas.oidc.profile.OidcProfileScopeToAttributesFilter] - <Request does not indicate a scope [[ala, roles]] that can identify an OpenID Connect request. This is a REQUIRED scope that MUST be present in the request. Given its absence, CAS will not process any attribute claims and will return the authenticated principal as is.>

Client application log:

2024-03-15 15:15:50.314  WARN --- [nio-8080-exec-9] o.p.oidc.profile.creator.TokenValidator  : Preferred JWS algorithm: null not available. Using all metadata algorithms: [RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, HS256, HS384, HS512]
@matsbov matsbov added the invalid This doesn't seem right label Jun 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

1 participant