Hi, it looks like somewhere between CAS 5.x and CAS 6.x (currently testing with CAS 6.6.9), the code that fetched user attributes from registered-service-defined release policy got removed from within the *grantProxyTicket()* method of *DefaultCentralAuthenticationService*.
As a result, user attributes check fails against the registered-service-defined access strategy when asking for a PT (proxy ticket), provided we check there an attribute which is only fetched via the registered-service-defined release policy (and is not available in *authentication.principal* from the time of login). Anyone experiencing the same issue? What can be the reason why policy attributes are fetched within *grantServiceTicket()*, but not within *grantProxyTicket()*? I think this can be just a coding mistake, but maybe there is some hidden intention behind that change? The ever higher difference between these 2 methods, which used to be just 1 in CAS 4, quite puzzles me... Regards Petr -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c16c177d-0038-4130-bf03-0e626298dd40n%40apereo.org.
