Shibcas + Duo

[Cantor, Scott]

On 8/9/17, 12:17 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> The latest release of Shibcas works fine with 3.3.1 and does proper subject canonicalization.  The biggest gotcha for me was that
> newer versions default to CAS 3.0.

Obviously if it's been updated it should work fine.

Nor is it required that you just blindly consume the value. It would not be normal for a Duo deployment to "not care" what the username was, you have to enroll tokens against the names and you certainly don't want to enroll them against multiple namespaces representing the same users if you don't have to. For reporting sanity if nothing else.

My deployment does attribute-based subject c14n after password validation via my attribute resolver to remap a username from about 5 different namespaces down into our official one. That's what all the extra complexity is there for.

-- Scott