IDP 3.3.2 CAS protocol and alternate CAS username difficulty

[Mak, David]

> Is it actually a feature to control what's in the SAML NameID in whatever non-SAML thing CAS made up? I think the username customization is for general CAS "proper". Do the docs suggest this is possible?

The docs do indeed suggest this is possible in the documentation https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration#app-switcher at the bottom section titled "Alternate cas:user in the validation response."

I am making the assumption that the SAML1 NameIdentifier field maps to the cas:user username field, but when I decode the CAS response sent to the service, it is indeed not changed from the default principal name.

> If the data is passed in the AttributeStatement properly, that may be what its meant to be doing. I say that from a very uninformed look at the code. The non-SAML validation response logic mentions plowing through IdPAttributes and shows it backing off the the principal name in the ticket state, and the SAML case to me seems to just use the ticket state.

From my even more uninformed look at the code, I do see in the PrepareTicketValidationResponseAction class, where the CAS TicketValidationResponse.userName is set to the new principal value as specified in the relaying party config. I also see, what you're saying (I think) in net.shibboleth.idp.cas.flow.impl.BuildSamlValidationSuccessMessageAction where the principal gets reset to the ticket state.

I guess I'm just trying to replicate the old Apereo CAS implementation we had where we could override the principal name with another attribute by specifying that such as:

                        <bean class="org.jasig.cas.services.RegisteredServiceImpl">
                                <property name="id" value="7" />
                                <property name="name" value="Student Success" />
                                <property name="description" value="Student Success" />
                                <property name="serviceId" value="https://ssc.advisory.com/**" />
                                <property name="evaluationOrder" value="10000007" />
                                <property name="usernameAttribute" value="neuedunuid" />
                                <property name="allowedAttributes">
                                        <list>  
                                                <value>neuedunuid</value>
                                        </list>
                                </property>
                        </bean>