{"action":"reopened","issue":{"url":"https://api.github.com/repos/apereo/cas/issues/2406","repository_url":"https://api.github.com/repos/apereo/cas","labels_url":"https://api.github.com/repos/apereo/cas/issues/2406/labels{/name}","comments_url":"https://api.github.com/repos/apereo/cas/issues/2406/comments","events_url":"https://api.github.com/repos/apereo/cas/issues/2406/events","html_url":"https://github.com/apereo/cas/issues/2406","id":209564135,"number":2406,"title":"openid 2.0 identifier_select doesn't return username","user":{"login":"icukeng","id":9694146,"avatar_url":"https://avatars.githubusercontent.com/u/9694146?v=3","gravatar_id":"","url":"https://api.github.com/users/icukeng","html_url":"https://github.com/icukeng","followers_url":"https://api.github.com/users/icukeng/followers","following_url":"https://api.github.com/users/icukeng/following{/other_user}","gists_url":"https://api.github.com/users/icukeng/gists{/gist_id}","starred_url":"https://api.github.com/users/icukeng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/icukeng/subscriptions","organizations_url":"https://api.github.com/users/icukeng/orgs","repos_url":"https://api.github.com/users/icukeng/repos","events_url":"https://api.github.com/users/icukeng/events{/privacy}","received_events_url":"https://api.github.com/users/icukeng/received_events","type":"User","site_admin":false},"labels":[{"id":395557548,"url":"https://api.github.com/repos/apereo/cas/labels/Not%20an%20Issue","name":"Not an Issue","color":"e11d21","default":false},{"id":114073502,"url":"https://api.github.com/repos/apereo/cas/labels/Won't%20Fix","name":"Won't Fix","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-02-22T20:00:47Z","updated_at":"2017-02-23T07:48:54Z","closed_at":null,"body":"Hello,\r\nI have some weird behavior with openid 2 in CAS.\r\nRP correctly redirects through yadis to OP with identifier_select\r\n```\r\nopenid.ns:\"http://specs.openid.net/auth/2.0\"\r\nopenid.mode:\"checkid_setup\"\r\nopenid.return_to:\"http://localhost:8080/\"\r\nopenid.realm:\"http://localhost:8080\"\r\nopenid.ns.ax:\"http://openid.net/srv/ax/1.0\"\r\nopenid.ax.mode:\"fetch_request\"\r\nopenid.ax.type.namePerson:\"http://axschema.org/namePerson\"\r\nopenid.ax.required:\"namePerson\"\r\nopenid.ns.sreg:\"http://openid.net/extensions/sreg/1.1\"\r\nopenid.sreg.required:\"fullname\"\r\nopenid.claimed_id:\"http://specs.openid.net/auth/2.0/identifier_select\"\r\nopenid.identity:\"http://specs.openid.net/auth/2.0/identifier_select\"\r\n```\r\nI can enter both username and password (so I suppose identifier_select was understood).\r\nBut redirect back  does not provide correct identity\r\n```\r\nopenid.return_to:\"http://localhost:8080/\"\r\nopenid.identity:\"http://specs.openid.net/auth/2.0/identifier_select\"\r\nopenid.op_endpoint:\"https://cas.example.org:8443/cas/login\"\r\nopenid.assoc_handle:\"1486724928189-12\"\r\nopenid.mode:\"id_res\"\r\nopenid.signed:\"op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle\"\r\nopenid.sig:\"P5CeYGbXNsA4K7VNNUyurn6fZZ93gXZiXTpOQJJWuHo=\"\r\nopenid.claimed_id:\"http://specs.openid.net/auth/2.0/identifier_select\"\r\nopenid.response_nonce:\"2017-02-22T19:22:44Z0\"\r\nopenid.ns:\"http://specs.openid.net/auth/2.0\"\r\n```\r\nclaimed_id and identity both have no useful informatiln about user.\r\nHowever  if I send url with user  - everything working like a charm.\r\n\r\nI've tried to investigate the situation.\r\nhttps://github.com/apereo/cas/blob/061ee6686b008f84ec7c37f0e4d15714426fa981/support/cas-server-support-openid/src/main/java/org/apereo/cas/support/openid/web/flow/OpenIdSingleSignOnAction.java\r\nSeems like in getOpenIdSelectedIdentifier function there is condition for valid username url substitution for IDENTIFIER_SELECT mode.\r\n```\r\nif (OpenIdProtocolConstants.OPENID_IDENTIFIERSELECT.equals(openidIdentityParameter)) {\r\n       ......\r\n       final Principal p = ticketRegistrySupport.getAuthenticatedPrincipalFrom(ticketGrantingTicketId);\r\n       if (p != null) {\r\n             return p.getId();\r\n       }\r\n       return OpenIdProtocolConstants.OPENID_IDENTIFIERSELECT;\r\n}\r\n```\r\nI think that \"p\" is null here for some reason.\r\n"}}
{"actor":{"display_login":"mmoayyed"}}