/*
 * Licensed to Apereo under one or more contributor license
 * agreements. See the NOTICE file distributed with this work
 * for additional information regarding copyright ownership.
 * Apereo licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file
 * except in compliance with the License.  You may obtain a
 * copy of the License at the following location:
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.jasig.cas.support.pac4j.authentication.handler.support;

import org.apache.commons.lang3.StringUtils;
import org.jasig.cas.authentication.BasicCredentialMetaData;
import org.jasig.cas.authentication.DefaultHandlerResult;
import org.jasig.cas.authentication.HandlerResult;
import org.jasig.cas.authentication.PreventedException;
import org.jasig.cas.support.pac4j.authentication.principal.ClientCredential;
import org.pac4j.core.client.Clients;
import org.pac4j.core.profile.UserProfile;

import javax.security.auth.login.FailedLoginException;
import java.security.GeneralSecurityException;

/**
 * Specialized handler which builds the authenticated user directly from the retrieved user profile.
 *
 * @author Jerome Leleu
 * @author Longze Chen
 * @since 4.1.0
 */
public class ClientAuthenticationHandler extends AbstractClientAuthenticationHandler {

    /**
     * Whether to use the typed identifier (by default) or just the identifier.
     */
    private boolean typedIdUsed = true;

    /**
     * Define the clients.
     *
     * @param theClients The clients for authentication
     */
    public ClientAuthenticationHandler(final Clients theClients) {
        super(theClients);
    }

    /**
     * {@inheritDoc}
     */
    @Override
    protected HandlerResult createResult(final ClientCredential credentials, final UserProfile profile)
            throws GeneralSecurityException, PreventedException {

        final String clientName = credentials.getCredentials().getClientName();
        final String id;
        // Customize profile names for different CAS Clients using the pre-configured client names
        if (clientName != null && clientName.startsWith("CasClient")) {
            id = clientName + "Profile#" + profile.getId();
        } else if (typedIdUsed) {
            id = profile.getTypedId();
        } else {
            id = profile.getId();
        }
        if (StringUtils.isNotBlank(id)) {
            credentials.setUserProfile(profile);
            credentials.setTypedIdUsed(typedIdUsed);
            return new DefaultHandlerResult(
                    this,
                    new BasicCredentialMetaData(credentials),
                    this.principalFactory.createPrincipal(id, profile.getAttributes()));
        }
        throw new FailedLoginException("No identifier found for this user profile: " + profile);
    }

    public boolean isTypedIdUsed() {
        return typedIdUsed;
    }

    public void setTypedIdUsed(final boolean typedIdUsed) {
        this.typedIdUsed = typedIdUsed;
    }
}

@@ -1210,16 +1210,74 @@
 ential;%0A
+import org.jasig.cas.support.pac4j.web.flow.ClientAction;%0A
 import o
@@ -2387,16 +2387,55 @@
 ing id;%0A
+%0A        if (clientName != null) %7B%0A    
         
@@ -2437,17 +2437,17 @@
      // 
-C
+c
 ustomize
@@ -2464,311 +2464,910 @@
 ames
- for different CAS Clients using the pre-configured client names%0A        if (clientName != null && clientName.startsWith(%22CasClient%22)) %7B%0A            id = clientName + %22Profile#%22 + profile.getId();%0A        %7D else if (typedIdUsed) %7B%0A            id = profile.getTypedId();%0A        %7D else %7B%0A            id =
+%0A            if (ClientAction.INSTITUTION_CLIENTS.contains(clientName)) %7B%0A                // institution clients are independent of authentication delegation protocol%0A                // institution id and client name are identical%0A                id = clientName + '#' + profile.getId();%0A            %7D else if (clientName.startsWith(%22CasClient%22)) %7B%0A                // non-institution cas clients: e.g. there can be many CAS clients%0A                id = clientName + %22Profile#%22 + profile.getId();%0A                // currently there is no client of this type%0A                // this also requires OSF side implementation to generalize what we did for ORCiD%0A                throw new FailedLoginException(%22Client not supported.%22);%0A            %7D else %7B%0A                // non-institution unique clients: e.g. there can only be one ORCiD clients%0A                id = isTypedIdUsed() ? profile.getTypedId() :
  pro
@@ -3380,34 +3380,42 @@
 etId();%0A        
+  
-%7D%0A
+  %7D%0A    
         if (Stri
@@ -3444,32 +3444,36 @@
 ) %7B%0A            
+   
+ 
 credentials.setU
@@ -3489,24 +3489,28 @@
 e(profile);%0A
+    
             
@@ -3558,24 +3558,28 @@
             
+  
+  
 return new D
@@ -3615,24 +3615,28 @@
             
+    
 this,%0A      
@@ -3649,16 +3649,20 @@
         
+ 
+   
 new Basi
@@ -3695,16 +3695,20 @@
 tials),%0A
+    
         
@@ -3796,26 +3796,32 @@
         
-%7D%0A
+    %7D%0A  
         
 throw ne
@@ -3804,32 +3804,34 @@
     %7D%0A          
+  
 throw new Failed
@@ -3899,24 +3899,132 @@
 + profile);%0A
+        %7D%0A        throw new FailedLoginException(%22No client name found for this user profile: %22 + profile);%0A
     %7D%0A%0A    p

Update pac4j class ClientAuthenticationHandler to customize principal id for institution login purpose.