Providing attributes from CAS

[Joshua Riffle]

This is very generalize but basically CAS only shifts the primary authority
token (the user name) over to Shibboleth which typically uses it as the
principal name to resolve and retrieve other attributes. At APU, even
though CAS releases more attributes than username, Shibboleth is only aware
of the main attribute (user name) which I believe is sent over as a session
variable. Shibboleth uses another data source (LDAP, DBMS) to look up the
additional attributes for the authenticated user.


Joshua Riffle
Software Engineer
*Azusa Pacific University*


On Mon, Apr 8, 2013 at 9:54 AM, Stein, Eric <steine at locustec.com> wrote:

> Okay, so whatever I can convince CAS to put in will come out of Shibboleth
> with no further tinkering?
>
> Does Shibboleth put the username in by default, or do I have to flip a
> switch somewhere? If by default, how do I see it? I'm dumping all the
> headers, attributes, etc from a shibbolized app, and I don't see it.
>
> Thanks,
> Eric Stein
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
> On Behalf Of Cantor, Scott
> Sent: Monday, April 08, 2013 12:52 PM
> To: Shib Users
> Subject: Re: Providing attributes from CAS
>
> On 4/8/13 12:48 PM, "Stein, Eric" <steine at locustec.com> wrote:
>
> >I'm running Shibboleth IdP with CAS 3.5.1 as my authentication provider.
> >I'd like to provide a username attribute (and possibly others later) to
> >SPs. What is the right way to tackle this? I assume I need CAS to
> >somehow make the attribute available to Shibboleth, but that runs
> >contrary to the documentation I found
> >(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute).
>
> Well, the username is built-in, otherwise it depends on how the data is
> made available from CAS, on which I cannot comment.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130408/394ab171/attachment.html