Providing attributes from CAS

[Stein, Eric]

Got it sorted. I forgot to add a filter for the uid.

Thanks, all!

Eric Stein

From: Stein, Eric
Sent: Tuesday, April 09, 2013 3:48 PM
To: Shib Users
Subject: RE: Providing attributes from CAS


Thanks, fixed. I'm seeing "No Attribute Statement", which means that the attribute isn't being released. Can you see something wrong in this configuration?



<resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="our_user_name">

    <resolver:Dependency ref="ATTRIBUTE_DATA_CONNECTOR" />

    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />

    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />

</resolver:AttributeDefinition>



<resolver:DataConnector xsi:type="RelationalDatabase"

                        xmlns="urn:mace:shibboleth:2.0:resolver:dc"

                        id="ATTRIBUTE_DATA_CONNECTOR"

                        queryUsesStoredProcedure="false"

                        noResultIsError="true">



    <ApplicationManagedConnection jdbcDriver="net.sourceforge.jtds.jdbc.Driver"

                                  jdbcURL="jdbc:jtds:sqlserver://our_database_server:1433/our_user_database "

                                  jdbcUserName="db_username "

                                  jdbcPassword="db_password" />



    <QueryTemplate>

        <![CDATA[

            SELECT our_user_name FROM our_user_table WHERE our_user_name='$requestContext.principalName'

        ]]>

    </QueryTemplate>



</resolver:DataConnector>



Eric Stein



-----Original Message-----
From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net]<mailto:[mailto:users-bounces at shibboleth.net]> On Behalf Of Cantor, Scott
Sent: Tuesday, April 09, 2013 3:29 PM
To: Shib Users
Subject: Re: Providing attributes from CAS



On 4/9/13 3:23 PM, "Stein, Eric" <steine at locustec.com<mailto:steine at locustec.com>> wrote:



>I set up all the configuration as detailed in the documents Benjamin

>referenced. When I log in from a web browser, no errors are logged but

>I'm still not seeing the username in the request/session headers. When

>I try to run aacli, there's  still nothing in the log, but on the

>console I'm seeing the stack trace below. I'm not really sure why aacli

>would need ServletRequest. Does anybody know what might be going on?



https://issues.shibboleth.net/jira/browse/SIDP-557



Just copy the jar in from your container to idp/lib



AACLI is fine, but your IdP log will already give you the same information when you try to use it, the attribute resolution is tracked in the same way.



-- Scott





--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130409/264e71d3/attachment-0001.html