Change username in CAS response?

[Tom Zeller]

> On Jun 29, 2016, at 5:24 PM, Lucia Siochi <Lucia.Siochi at cpcc.edu> wrote:
> 
> Hello,
>  
> Is it possible (or readily do-able) to modify the username returned in the CAS response? We need the usernames to be returned in whichever case (upper/lower) they had originally, instead of always in lower-case. We want to make this change only for CAS.  We were thinking of editing the response before it is sent out by replacing the lower-cased username with the value of another attribute that contains the originally-cased username.
>  
> Some context:
> We are implementing IdPv3’s built-in CAS with the intention of replacing our current jasig-cas service. For the most part it seems to be working, except for certain clients. Our current jasig cas instance returns the username in whichever case the username was in from the data source. Between our two AD domains, one domain has the usernames in lower-case, and the other domain in upper-case. As a result, some of our CAS clients created accounts with some usernames in uppercase and some usernames in lower-case. Since shib returns the usernames in lower-case, regardless of the case the username originally was in, some of our CAS clients don’t authenticate some valid accounts (the ones in upper-case).  
>  
> I did locate shib’s CAS velocity templates, but they are in /opt/shibboleth-idp/system/views/cas, which as I understand it, should not be customized!
>  
> I saw there is a username reference in validateSuccess.vm, which comes from a variable:   
> <cas:user>$escapeUtils.escapeXml($ticketValidationResponse.userName)</cas:user>
> Can I change the value of $ticketValidationResponse.userName just before the response is generated? If so, how? Is this a bad idea or will it cause problems?
>  
> Or is there a better way to get the originally-cased username value in the CAS Response?

Because IdPv3 does not by default change the case of usernames, I assume you have enabled the lowercase username transform during subject c14n. To activate subject c14n username transforms just for CAS, I think you would need to create a new c14n flow, probably by copying the simple or attribute-sourced c14n flow, and provide an activation condition which compares the (ProfileRequestContext) profile ID to the CAS profile IDs.

HTH,
Tom