change user in CAS serviceResponse element

[Marvin Addison]

>
> How do I change what is sent for the value of <cas:user>?
>
> I would think that's just coming from the subject's canonical principal
> name?
>

Yes, but in a roundabout way that may be relevant. Since the CAS ticket
validation process is a back channel message exchange that necessarily
happens _after_ authentication, the only available source of principal is
from an existing IdP session. Thus the CAS <user> element is populated from
SessionContext.getIdPSession().getPrincipalName(). The session principal is
of course driven by subject canonicalization, but unfortunately it's not
driven directly by protocol and relying party as with SAML flows. Thus
subject canonicalization does not run at ticket validation time where you
could run a different canonicalization flow to get a different sort of
principal for the CAS protocol. Ideally the subject canonicalization flow
would run at ticket validation time, but it wasn't clear to me how to do
that initially. I'm open to suggestions for improvement.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150713/6a0deae2/attachment.html>