IDP 3.3.2 CAS protocol and alternate CAS username difficulty

[Mak, David]

Michael,

Do you think this is a bug in the implementation or is this local to our setup? Would it help to open a jira issue for this?

From: users <users-bounces at shibboleth.net> on behalf of "Mak, David" <d.mak at northeastern.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, April 12, 2018 at 5:35 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3.2 CAS protocol and alternate CAS username difficulty


This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing<http://aka.ms/LearnAboutSpoofing>

Feedback<http://aka.ms/SafetyTipsFeedback>

Odd. I’ve just commented out the configuration I had for this attribute in saml nameid and I see no change, no exception as before. Not sure of how I was able to generate that null value condition, but it may actually have been some other development work on our directory server that caused it. Again, apologies for the confusion. As Scott and Michael indicated, CAS does not appear to have anything to do with the saml nameid configuration.

From: users <users-bounces at shibboleth.net> on behalf of "Mak, David" <d.mak at northeastern.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, April 12, 2018 at 4:46 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3.2 CAS protocol and alternate CAS username difficulty


This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing<http://aka.ms/LearnAboutSpoofing>

Feedback<http://aka.ms/SafetyTipsFeedback>

Sorry for the confusion. That condition, with the “Filtered attribute neuEduNUID has no value” in the log only occurs if I comment out the saml-nameid.xml section I detailed. I only added it in there because it seemed as if having the attribute defined in the attribute resolver and filter configs wasn’t sufficient (see below for config excerpts.) With, or without that saml nameid configuration, other SAML2 or CAS end points that depend on that attribute (neuEduNUID) do get it with valid values. In my first message, where I included the SOAP payload, that attribute is released as an attribute, but just not as the name identifier. There may be some other odd interaction / configuration issue on our end that might explain why I have to add that attribute to the saml-nameid configuration, but it does get us further.

Resolver config:
  <resolver:AttributeDefinition id="neuEduNUID" xsi:type="ad:Simple" sourceAttributeID="neuEduNUID">
    <resolver:Dependency ref="myLDAP"/>
    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:neuEduNUID"/>
    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:neuEduNUID-OID" friendlyName="neuEduNUID"/>
  </resolver:AttributeDefinition>

Filter config:
<AttributeFilterPolicy id="BANNER" >
      <PolicyRequirementRule xsi:type="OR">
              <Rule xsi:type="RequesterRegex" regex="https://bnrxe.*\.neu\.edu(:\d+)?/.*"/>
              <Rule xsi:type="RequesterRegex" regex="https://nubanner\.(northeastern|neu)\.edu(:\d+)?/.*"/>
      </PolicyRequirementRule>
      <AttributeRule attributeID="UDC_IDENTIFIER">
         <PermitValueRule xsi:type="ANY" />
      </AttributeRule>
      <AttributeRule attributeID="neuEduNUID">
         <PermitValueRule xsi:type="ANY" />
      </AttributeRule>
</AttributeFilterPolicy>



From: users <users-bounces at shibboleth.net> on behalf of Michael A Grady <mgrady at unicon.net>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, April 12, 2018 at 4:18 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3.2 CAS protocol and alternate CAS username difficulty


On Apr 12, 2018, at 2:53 PM, Mak, David <d.mak at northeastern.edu<mailto:d.mak at northeastern.edu>> wrote:

Thank you, Michael. The logs indicate that our relaying party configuration, which was essentially that example, modified as below, seems to be matched to the configuration, but the results just don’t match. To answer Scott’s comment, if I comment out/remove the SAML1NameIdentifierGenerators in the saml-nameid.xml config, I get the following exception:

2018-04-12 15:12:05,035 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:93] - Filtered attribute neuEduNUID has no value
2018-04-12 15:12:05,036 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception
java.lang.IllegalStateException: Principal cannot be null

As Scott said, I don't think the saml-nameid.xml config has anything to do with CAS. (If it does, that is a new knowledge for me also.)  The above says "Filtered attribute neuEduNUID has no value". Do you have an attribute with an ID of 'neuEduNUID' defined in your resolver, and does the resolver logging show that it successfully got populated with a value?

--
Michael A. Grady
IAM Architect, Unicon, Inc.






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180413/3092817b/attachment.html>