opengrok+tomcat9+cas+whitelist cannot get opengrok-user-plugin-user attribute

[geyy472]

I delpoy opengrok with tomcat 9
because my company is only allowed to use oauth or cas to login,
I use cas-client-core-3.6.4.jar and config it in tomcat success

but when I use opengrok UserWhiteListPlugin, it's doesn't work
In logs/catalina.out:

WARNING [http-nio-8080-exec-4] opengrok.auth.plugin.UserWhiteListPlugin.checkWhitelist cannot get opengrok-user-plugin-user attribute

so how can I allow UserWhiteListPlugin to get the login-user?

read-only.xml:

<?xml version="1.0" encoding="UTF-8"?>
<java version="11.0.16.1" class="java.beans.XMLDecoder">
  <object class="org.opengrok.indexer.configuration.Configuration" id="Configuration0">
    <void property="pluginStack">
	<void method="add">
                <object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
                    <void property="name">
                        <string>opengrok.auth.plugin.UserPlugin</string>
                    </void>
                    <void property="flag">
                        <string>REQUISITE</string>
                    </void>
                    <void property="setup">
                        <void method="put">
                             <string>decoder</string>
                             <string>opengrok.auth.plugin.decoders.OSSOHeaderDecoder</string>
                        </void>
		    </void>
		    <void property="name">
                        <string>opengrok.auth.plugin.UserWhiteListPlugin</string>
                    </void>
                    <void property="flag">
                        <string>REQUIRED</string>
		    </void>
		    <void property="setup">
			<void method="put">
                             <string>fieldName</string>
                             <string>id</string> <!-- non-default -->
                        </void>
                        <void method="put">
                             <string>file</string>
                             <string>/opengrok/etc/whitelist.txt</string>
		         </void>
		     </void>
                </object>
	</void>
    </void>
  </object>
</java>

[vladak]

UserPlugin is expected to grab certain HTTP headers from the request. It depends on the decoder what HTTP headers will be interpreted as login name and login ID. It then converts these headers into internal request properties that are passed to the subsequent authorization plugins that are down the authorization stack. That is why UserPlugin is usually configured with the REQUISITE flag.

Now, the OSSOHeaderDecoder you have configured is specifically written to decode Oracle SSO headers as noted on https://github.com/oracle/opengrok/wiki/Authorization-plugins#decoders so unless you are running the OHS configured with the mod_osso, this will not work.

I don't know what cas-client-core is and how it performs authentication, that is something you need to figure out yourself. If it can pass the authenticated user information via HTTP headers or put this information into the request object, new UserPlugin decoder can be written to extract these.