Shibcas + Duo

[Klingenstein, Nate]

We were getting the same principal back from CAS that we expected to use with Duo, so there was no mystery involved, no need to do anything special.  Shibcas will set a principal itself.  It looks almost identical to doing any other authentication + Duo out of the box when configured.


The latest release of Shibcas works fine with 3.3.1 and does proper subject canonicalization.  The biggest gotcha for me was that newer versions default to CAS 3.0.


I would imagine username transmutation would be possible at several points.  It would just be gross at any one of them.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Justin Andrews <jandrews at uwf.edu>
Sent: Wednesday, August 9, 2017 7:52:00 AM
To: Shib Users
Subject: Re: Shibcas + Duo

Thank you Nate - for those using Shibcas & Duo within Shibboleth - how are you retrieving the value returned by CAS to pass onto Duo? Thank you!


Scott has provided some guidance related to this below:

On 8/9/17, 8:39 AM, "users on behalf of Justin Andrews" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of jandrews at uwf.edu<mailto:jandrews at uwf.edu>> wrote:

> I guess I'm just wondering how I get that value being returned from Shibcas...

That isn't my code, so there's no way for me to answer that without looking at it.

I imagine it's inside the Subject produced by the flow in a Principal subclass of some sort. Results produced by flows are inside the active results collection attached to the MFA context.

> What function would pull it out of mfaCtx?

No single function could.

It seems to me you should perhaps ask its author to either update and certify it for use with 3.3 or dump it.

As a stand-alone feature, it is compatible with 3.3. As a part of the MFA subsystem that was added in 3.3, it's not.

Justin Andrews
Enterprise Systems Integrator
Information Technology Services
University of West Florida

On Mon, Aug 7, 2017 at 11:09 AM, Klingenstein, Nate <nklingenstein at calstate.edu<mailto:nklingenstein at calstate.edu>> wrote:

Justin,


Yes, several.  I'd make sure you're using the latest libraries and the biggest gotcha I hit was some CAS servers that still don't support CAS 3.0.  It was otherwise relatively straightforward.


You could ask specific questions here or of the Shibcas team directly, probably.


Hope this helps,

Nate.

________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Justin Andrews <jandrews at uwf.edu<mailto:jandrews at uwf.edu>>
Sent: Monday, August 7, 2017 7:56:13 AM
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Shibcas + Duo

Hi folks - does anyone have a working IDP with Shibcas & Duo?

Asking for a sanity check, thanks.

Justin Andrews
Enterprise Systems Integrator
Information Technology Services
University of West Florida

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170809/651242b2/attachment.html>