title: Cipher "clientSecret" params in OAuth2 JWT Token CAS Apereo version 6.1.7
body: <p>I follow this instruction to cipher &quot;clientSecret&quot; params in OAuth2 JWT Token with CAS Apereo 6.1
  <a href="https://apereo.github.io/2019/11/04/cas62x-oauth-jwt-access-token/" rel="nofollow noreferrer">https://apereo.github.io/2019/11/04/cas62x-oauth-jwt-access-token/</a></p>
  <p>Step 1: Using CAS Shell to cipher clientSecret</p>
  <pre><code>root@ubuntu16:~/lam/cas-overlay-template# ./gradlew downloadShell runShell
  root@ubuntu16:~/lam/cas-overlay-template# java -jar build/libs/cas-server-support-shell-6.1.7.jar
  cas&gt;encrypt-value value exampleOauthClientSecret alg PBEWithMD5AndTripleDES provider SunJCE password Vnpt@123 iterations 1000
  ==== Encrypted Value ====
  {cas-cipher}La813rUHz0m2XM/DwqjvGtHPX+l8XtMzI80UGXH24uDMGXCqsAYFfg==
  cas&gt;decrypt-value value {cas-cipher}La813rUHz0m2XM/DwqjvGtHPX+l8XtMzI80UGXH24uDMGXCqsAYFfg== alg PBEWithMD5AndTripleDES provider SunJCE password Vnpt@123 iterations 1000
  
  ==== Decrypted Value ====
  exampleOauthClientSecret
  </code></pre>
  <p>Step 2: I make service  registration like this</p>
  <pre><code>root@ubuntu16:/etc/cas/services-repo# cat OAuthJWTService-3.json
  {
      &quot;@class&quot; : &quot;org.apereo.cas.support.oauth.services.OAuthRegisteredService&quot;,
      &quot;clientId&quot;: &quot;exampleOauthClient&quot;,
     #&quot;clientSecret&quot;: &quot;exampleOauthClientSecret&quot;,
      &quot;clientSecret&quot;: &quot;{cas-cipher}La813rUHz0m2XM/DwqjvGtHPX+l8XtMzI80UGXH24uDMGXCqsAYFfg==&quot;,
      &quot;serviceId&quot; : &quot;^https://cascore.vdc2.com.vn:9999/.*&quot;,
      &quot;name&quot; : &quot;OAuthJWTService&quot;,
      &quot;id&quot; : 3,
      &quot;jwtAccessToken&quot;: true,
      &quot;attributeReleasePolicy&quot; : {
          &quot;@class&quot; : &quot;org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy&quot;,
          &quot;allowedAttributes&quot; : [ &quot;java.util.ArrayList&quot;, [&quot;comdepartment&quot;,&quot;comid&quot;,&quot;lastname&quot;,&quot;usercode&quot;,&quot;userdate&quot;,&quot;useremail&quot;,&quot;userparentid&quot;,&quot;userstatus&quot;,&quot;usertel&quot;,&quot;usertype&quot; ] ]
   },
          &quot;properties&quot; : {
          &quot;@class&quot; : &quot;java.util.HashMap&quot;,
          &quot;accessTokenAsJwtSigningKey&quot; : {
              &quot;@class&quot; : &quot;org.apereo.cas.services.DefaultRegisteredServiceProperty&quot;,
              &quot;values&quot; : [ &quot;java.util.HashSet&quot;, [ &quot;CoSfJ2WweU-cWcUYSjW2PWLVLd9hIVG0xxjFFUHSUbCjkkNiwPli_WlqF9V2MHJH3SGH_4DifSYxlgs98h4snA&quot; ] ]
    },
              &quot;accessTokenAsJwtEncryptionKey&quot; : {
              &quot;@class&quot; : &quot;org.apereo.cas.services.DefaultRegisteredServiceProperty&quot;,
              &quot;values&quot; : [ &quot;java.util.HashSet&quot;, [ &quot;_3gpqpSiIEjHT0xlscGvgDr0-iPIeeEeyecfFgbg_5E&quot; ] ]
        },
        &quot;accessTokenAsJwtSigningEnabled&quot; : {
             &quot;@class&quot; : &quot;org.apereo.cas.services.DefaultRegisteredServiceProperty&quot;,
             &quot;values&quot; : [ &quot;java.util.HashSet&quot;, [ &quot;true&quot; ] ]
        },
        &quot;accessTokenAsJwtEncryptionEnabled&quot; : {
             &quot;@class&quot; : &quot;org.apereo.cas.services.DefaultRegisteredServiceProperty&quot;,
             &quot;values&quot; : [ &quot;java.util.HashSet&quot;, [ &quot;true&quot; ] ]
        },
        &quot;accessTokenAsJwtCipherStrategyType&quot; : {
            &quot;@class&quot; : &quot;org.apereo.cas.services.DefaultRegisteredServiceProperty&quot;,
             &quot;values&quot; : [ &quot;java.util.HashSet&quot;, [ &quot;SIGN_AND_ENCRYPT&quot; ] ]
        }
     }
  }
  </code></pre>
  <p>Step 3: I config CAS Apereo global like this (my global config store in MongoDB)</p>
  <pre><code>{&quot;_id&quot;:{&quot;$oid&quot;:&quot;5f058f62ee9a446824d4adf3&quot;},&quot;name&quot;:&quot;org.apereo.cas.standalone.configurationSecurity.alg&quot;,&quot;value&quot;:&quot;PBEWithMD5AndTripleDES&quot;}
  {&quot;_id&quot;:{&quot;$oid&quot;:&quot;5f058f79ee9a446824d4adf4&quot;},&quot;name&quot;:&quot;org.apereo.cas.standalone.configurationSecurity.provider&quot;,&quot;value&quot;:&quot;SunJCE&quot;}
  {&quot;_id&quot;:{&quot;$oid&quot;:&quot;5f058f8aee9a446824d4adf5&quot;},&quot;name&quot;:&quot;org.apereo.cas.standalone.configurationSecurity.iterations&quot;,&quot;value&quot;:&quot;1000&quot;}
  {&quot;_id&quot;:{&quot;$oid&quot;:&quot;5f058f9dee9a446824d4adf6&quot;},&quot;name&quot;:&quot;org.apereo.cas.standalone.configurationSecurity.psw&quot;,&quot;value&quot;:&quot;Vnpt@123&quot;}
  </code></pre>
  <p>Step 4: I rebuild CAS
  Step 5: I call API to create JWT token like this</p>
  <pre><code>curl https://cascore.vdc2.com.vn:8443/cas/oauth2.0/token?grant_type=password'&amp;'client_id=exampleOauthClient'&amp;'client_secret=exampleOauthClientSecret'&amp;'username=abc'&amp;'password=Vnpt@123 | jq
  </code></pre>
  <p>But It shows this problem</p>
  <pre><code>{
    &quot;@class&quot;: &quot;java.util.LinkedHashMap&quot;,
    &quot;timestamp&quot;: [
       &quot;java.util.Date&quot;,
        1594370510760
     ],
    &quot;status&quot;: 401,
    &quot;error&quot;: &quot;Unauthorized&quot;,
    &quot;message&quot;: &quot;No message available&quot;,
    &quot;path&quot;: &quot;/cas/oauth2.0/token&quot;
  }
  </code></pre>
  <p>I try agin with this</p>
  <pre><code>curl https://cascore.vdc2.com.vn:8443/cas/oauth2.0/token?grant_type=password'&amp;'client_id=exampleOauthClient'&amp;'client_secret={cas-cipher}La813rUHz0m2XM/DwqjvGtHPX+l8XtMzI80UGXH24uDMGXCqsAYFfg=='&amp;'username=abc'&amp;'password=Vnpt@123 | jq
  </code></pre>
  <p>But it shows this error again</p>
  <pre><code>{
    &quot;@class&quot;: &quot;java.util.LinkedHashMap&quot;,
    &quot;timestamp&quot;: [
       &quot;java.util.Date&quot;,
       1594370510760
    ],
       &quot;status&quot;: 401,
       &quot;error&quot;: &quot;Unauthorized&quot;,
       &quot;message&quot;: &quot;No message available&quot;,
       &quot;path&quot;: &quot;/cas/oauth2.0/token&quot;
  }
  </code></pre>
  <p>Finally, I try change param to plain text in registration file from <code>&quot;clientSecret&quot;: &quot;{cas-cipher}La813rUHz0m2XM/DwqjvGtHPX+l8XtMzI80UGXH24uDMGXCqsAYFfg==&quot;</code>, to <code>&quot;clientSecret&quot;: &quot;exampleOauthClientSecret&quot;</code>,</p>
  <p>It works and gives me JWT token.</p>
  <p>Please help me.</p>
  <p>Thanks</p>