IDP 3.3.2 CAS protocol and alternate CAS username difficulty

[Mak, David]

Thank you, Michael. The logs indicate that our relaying party configuration, which was essentially that example, modified as below, seems to be matched to the configuration, but the results just don’t match. To answer Scott’s comment, if I comment out/remove the SAML1NameIdentifierGenerators in the saml-nameid.xml config, I get the following exception:

2018-04-12 15:12:05,035 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:93] - Filtered attribute neuEduNUID has no value
2018-04-12 15:12:05,036 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception
java.lang.IllegalStateException: Principal cannot be null
        at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)

Here’s the relaying party config:

        <!-- The following are CAS services that need to release the NUID instead of the default UID for the username returned to services -->
        <bean id="shibboleth.regexRelyingParty" parent="RelyingParty" >
            <property name="activationCondition" >
                <bean class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" >
                    <constructor-arg name="pred" >
                        <bean class="com.google.common.base.Predicates" factory-method="or" >
                            <constructor-arg>
                                <util:list>
                                    <bean class="com.google.common.base.Predicates" factory-method="containsPattern" c:_0="https://bnrxe.*\.neu\.edu\/.*" />
                                    <bean class="com.google.common.base.Predicates" factory-method="containsPattern" c:_0="https://neuidmssodev\.neu\.edu\/.*" />
                                </util:list>
                            </constructor-arg>
                        </bean>
                    </constructor-arg>
                </bean>
            </property>
            <property name="profileConfigurations">
                <list>
                    <ref bean="CAS.LoginConfiguration" />
                    <ref bean="CAS.ProxyConfiguration" />
                    <bean parent="CAS.ValidateConfiguration" p:userAttribute="neuEduNUID" />
                </list>
            </property>
        </bean>



From: users <users-bounces at shibboleth.net> on behalf of Michael A Grady <mgrady at unicon.net>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, April 12, 2018 at 3:45 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3.2 CAS protocol and alternate CAS username difficulty


On Apr 12, 2018, at 2:36 PM, Mak, David <d.mak at northeastern.edu<mailto:d.mak at northeastern.edu>> wrote:

’ve hit a block and would like to see if others might be able to point me in the right direction. On a IDP 3.3.2 setup with a CAS configuration setup to release a different attribute as the name-identifier, I see log entries that show it going through the process but the payload itself doesn’t have the said attribute value as the nameid, but instead, has the login id.

See the section entitled:

  Alternate cas:user in the validation response (Optional)

in the following Shib wiki page:

  https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180412/e8910a8b/attachment.html>