/**
 * Licensed to Jasig under one or more contributor license
 * agreements. See the NOTICE file distributed with this work
 * for additional information regarding copyright ownership.
 * Jasig licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file
 * except in compliance with the License. You may obtain a
 * copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on
 * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.jasig.portal.security.provider.cas.clearpass;

import org.jasig.cas.client.util.CommonUtils;
import org.jasig.cas.client.util.XmlUtils;
import org.jasig.cas.client.validation.Assertion;
import org.jasig.portal.security.IOpaqueCredentials;
import org.jasig.portal.security.provider.NotSoOpaqueCredentials;
import org.jasig.portal.security.provider.cas.CasAssertionSecurityContext;
import org.springframework.util.Assert;

/**
 * @author Scott Battaglia
 */
public class PasswordCachingCasAssertionSecurityContext extends CasAssertionSecurityContext {

    private static final long serialVersionUID = -3816036745827152340L;

    private final String clearPassUrl;

    private byte[] cachedCredentials;

    protected PasswordCachingCasAssertionSecurityContext(final String clearPassUrl) {
        super();
        Assert.notNull(clearPassUrl, "clearPassUrl cannot be null.");
        this.clearPassUrl = clearPassUrl;
    }

    @Override
    protected final void postAuthenticate(final Assertion assertion) {
        final String proxyTicket = assertion.getPrincipal().getProxyTicketFor(this.clearPassUrl);

        if (proxyTicket == null) {
            log.error("Unable to obtain proxy ticket for ClearPass service.");
            return;
        }

        final String password = retrievePasswordFromResponse(proxyTicket);

        if (password != null) {
            log.debug("Password retrieved from ClearPass.");
            this.cachedCredentials = password.getBytes();
        } else {
            log.debug("Unable to retrieve password from ClearPass.");
        }
    }

    @Override
    public final IOpaqueCredentials getOpaqueCredentials() {
        if (this.cachedCredentials == null) {
            return super.getOpaqueCredentials();
        }

        final NotSoOpaqueCredentials credentials = new CacheOpaqueCredentials();
        credentials.setCredentials(this.cachedCredentials);
        return credentials;
    }

    protected final String retrievePasswordFromResponse(final String proxyTicket) {
        final String url = this.clearPassUrl + (this.clearPassUrl.contains("?") ? "&" : "?") + "ticket=" + proxyTicket;
        final String response = retrieveResponseFromServer(url, "UTF-8");
        final String password = XmlUtils.getTextForElement(response, "credentials");


        if (log.isTraceEnabled()) {
            log.trace(String.format("ClearPass Response was:\n %s", response));
        }

        if (CommonUtils.isNotBlank(password)) {
            return password;
        }

        log.error("Unable to Retrieve Password.  If you see a [403] HTTP response code returned from the CommonUtils then it most likely means the proxy configuration on the CAS server is not correct.\n\n"
                + "Full Response from ClearPass was [" + response + "].");
        return null;
    }

    /**
     * Exists purely for testing purposes.
     */
    protected String retrieveResponseFromServer(final String url, final String encoding) {
        return CommonUtils.getResponseFromServer(url, "UTF-8");
    }


    /**
	 * Copied from {@link org.jasig.portal.security.provider.CacheSecurityContext}
	 */
	private class CacheOpaqueCredentials extends ChainingOpaqueCredentials implements NotSoOpaqueCredentials {

		private static final long serialVersionUID = 1l;

		public String getCredentials() {
		  return this.credentialstring != null ? new String(this.credentialstring) : null;
		}
	}

}

@@ -2034,36 +2034,73 @@
  %7D%0A%0A        
-final 
 String
+ password = null;%0A        try %7B%0A           
  password = 
@@ -2141,16 +2141,683 @@
 Ticket);
+%0A        %7D catch (Exception e) %7B%0A            /* %0A             * uPortal failed to obtain the user's password from the ClearPass %0A             * feature.  This issue commonly occurs in local dev environments %0A             * because CAS will not share the user's credential over a non-SSL %0A             * connection.  We need to log this event, but should not fail the %0A             * whole AuthN.%0A             */%0A            if (log.isWarnEnabled()) %7B%0A                log.warn(%22Unable to retrieve the credential from the ClearPass %22 +%0A                        %22service for principal:  %22 + assertion.getPrincipal().getName());%0A            %7D%0A            return;%0A        %7D
 %0A%0A      

Add a try/catch (with a WARN log) around obtaining the password from ClearPass so if that part fails, it won't sink the whole AuthN