Are scoped attributes supported for the CAS profile?

[Pavlos Drandakis]

Hello all,

I am using phpCAS client to authenticate and get attibutes from a 
Shibboleth IdP 3.3.0, by using the cas profile. It seems that the client 
gets/resolves scoped attributes as if they were unscoped (i.e the value 
of eduPersonPrincipalName shows as "auser" instead of
"auser at myscope.org").

Attribute definition in attribute-resolver-ldap.xml:

<AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" 
scope="myscope.org" sourceAttributeID="uid">
     <Dependency ref="myLDAP" />
     <AttributeEncoder xsi:type="SAML1ScopedString"
name="urn:mace:dir:attribute-def:eduPersonPrincipalName"
encodeType="false" />
     <AttributeEncoder xsi:type="SAML2ScopedString"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
friendlyName="eduPersonPrincipalName" encodeType="false" />
</AttributeDefinition>

Relevant entries in idp-process.log:

2017-02-09 15:35:10,095 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:189] - 
Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for 
attribute 'uid' remained after filtering
2017-02-09 15:35:10,096 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:189] - 
Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for 
attribute 'eduPersonPrincipalName' remained after filtering
2017-02-09 15:35:10,105 - DEBUG
[net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107]

- Processing IdPAttribute{id=uid, displayNames={},
displayDescriptions={},
encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML2StringAttributeEncoder at 7af7aa53,

net.shibboleth.idp.saml.attribute.encoding.impl.SAML1StringAttributeEncoder at e73c8147],

values=[StringAttributeValue{value=auser}]}
2017-02-09 15:35:10,108 - DEBUG
[net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107]

- Processing IdPAttribute{id=eduPersonPrincipalName, displayNames={}, 
displayDescriptions={},
encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML2ScopedStringAttributeEncoder at 23a131,

net.shibboleth.idp.saml.attribute.encoding.impl.SAML1ScopedStringAttributeEncoder at 5625d981],

values=[ScopedStringAttributeValue{value=auser, scope=myscope.org}]}
2017-02-09 15:35:10,133 - INFO [Shibboleth-Audit.SSO:241] -
20170209T133510Z|||http://myserver.mydomain.org/|https://www.apereo.org/cas/protocol/serviceValidate||||auser||uid,eduPersonPrincipalName|auser|ST-1486647308850-89GO6eFUMR8zHUN46PW7V9X6o|

Relevant entries in phpCAS.log:

CAS_Client::_setSessionAttributes('<?xml version="1.0"
encoding="UTF-8"?><SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><saml1p:Response

IssueInstant="2017-02-09T13:35:10.139Z" MajorVersion="1"
MinorVersion="1" ResponseID="ST-1486647308850-89GO6eFUMR8zHUN46PW7V9X6o" 
xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode

Value="saml1p:Success"/></saml1p:Status><saml1:Assertion
AssertionID="_37b2e18b3df9f92c181a9096e2f51e5c"
IssueInstant="2017-02-09T13:35:10.137Z"
Issuer="https://idp.mydomain.org/idp/shibboleth" MajorVersion="1" 
MinorVersion="1"
xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion"><saml1:Conditions 
NotBefore="2017-02-09T13:35:10.137Z"
NotOnOrAfter="2017-02-09T13:36:10.137Z"><saml1:AudienceRestrictionCondition><saml1:Audience>http://myserver.mydomain.org/</saml1:Audience></saml1:AudienceRestrictionCondition></saml1:Conditions><saml1:AuthenticationStatement

AuthenticationInstant="2017-02-09T13:35:10.137Z"
AuthenticationMethod="authn/Password"><saml1:Subject><saml1:NameIdentifier>auser</saml1:NameIdentifier><saml1:SubjectConfirmation><saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:artifact</saml1:ConfirmationMethod></saml1:SubjectConfirmation></saml1:Subject></saml1:AuthenticationStatement><saml1:AttributeStatement><saml1:Subject><saml1:NameIdentifier>auser</saml1:NameIdentifier><saml1:SubjectConfirmation><saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:artifact</saml1:ConfirmationMethod></saml1:SubjectConfirmation></saml1:Subject><saml1:Attribute

AttributeName="uid"
AttributeNamespace="http://www.ja-sig.org/products/cas/"><saml1:AttributeValue

xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">auser</saml1:AttributeValue></saml1:Attribute><saml1:Attribute

AttributeName="eduPersonPrincipalName"
AttributeNamespace="http://www.ja-sig.org/products/cas/"><saml1:AttributeValue

xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">auser</saml1:AttributeValue></saml1:Attribute></saml1:AttributeStatement></saml1:Assertion></saml1p:Response></SOAP-ENV:Body></SOAP-ENV:Envelope>'

CAS clients AFAIK don't have Scoped AttributeDecoders so... are scoped 
attributes supported for the CAS profile?

Thanks in advance,

Pavlos