Shib v3.2.1 cas-protocol authentication to BannerXe

[Jason Rotunno]

Hi,

On Fri, May 13, 2016 at 7:55 AM, Marvin Addison <marvin.addison at gmail.com>
wrote:

> On Thu, May 12, 2016 at 1:50 PM Niva Agmon <nagmon at temple.edu> wrote:
>
>> Has anyone been able to successfully configure authentication to BannerXe
>> (Banner9) using Shib v3.2.1 cas-protocol?
>>
> I'm fairly certain we have successfully done this.
>
>> We are getting access denied on the Banner side and it looks like the
>> user is null.
>>
> I've seen a number of Banner/CAS integration problems and most of them are
> related to attribute release. You must ensure that the UDC_IDENTIFIER
> attribute is coming over the wire. Put the org.jasig.cas package in DEBUG
> and make sure you see it in the ticket validation response.
>
>

We're attempting to get BEIS v8.3.2 working with Shibboleth/CAS v3.2
and sending
the UDC_IDENTIFIER attribute with the correct value over the wire seems to
be the issue we're having. The attribute is in the ticket validation
response but the Banner logs show the following:

INFO [com.ellucian.sso.ssb.dao.impl.SessionInitDaoImpl.<initSession>] -
Initializing a session for the Udc Id:ZERO_LENGTH_VALUE

Likewise, the Shibboleth logs produce this:

DEBUG
[net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedIdPAttributeImpl:220]
- Attribute Definition 'UDC_IDENTIFIER': scripted attribute
'UDC_IDENTIFIER': recreated attribute contents are
[EmptyAttributeValue{value=ZERO_LENGTH_VALUE}]

When testing Shibboleth with the aacli.sh script, the correct value for
UDC_IDENTIFIER is returned. When testing it with testshib, the shibd.log
says that it's "skipping unmapped SAML 2.0 Attribute with Name:
UDC_IDENTIFIER" but despite that the logs show that it has the correct
value.

When authenticating with Banner via CAS, however, it seems to send the
UDC_IDENTIFIER attribute with an empty value.

Unfortunately, I'm not particularly strong with Shibboleth or CAS and I'm
learning this as I go along.

Any tips would be appreciated.

Thanks,
Jason



-- 

Jason Rotunno
Systems Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505

IMPORTANT: Swarthmore College ITS staff will NEVER ask you for your
password, including by email!  Please keep your passwords private to
protect yourself and the security of our network.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160531/7c75c3c3/attachment.html>