Help setting up Shib's 3.4.3 Built-in CAS Server for Banner Apps
Tom O'Neill
oneill at sigcorp.com
Thu Feb 14 11:16:48 EST 2019
Melvin,
It sounds like you’re on the right track but the errors sound like there may be an issue with the underlying CAS configuration or possibly the LDAP settings.
According to the wiki, the relying-party.xml changes for CAS should be applied to the default relying party:
https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration
<bean id="shibboleth.DefaultRelyingParty<https://wiki.shibboleth.net/confluence/display/IDP30/shibboleth.DefaultRelyingParty>" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<ref bean="Shibboleth.SSO<https://wiki.shibboleth.net/confluence/display/IDP30/Shibboleth.SSO>" />
<ref bean="SAML1.AttributeQuery<https://wiki.shibboleth.net/confluence/display/IDP30/SAML1.AttributeQuery>" />
<ref bean="SAML1.ArtifactResolution<https://wiki.shibboleth.net/confluence/display/IDP30/SAML1.ArtifactResolution>" />
<ref bean="SAML2.SSO<https://wiki.shibboleth.net/confluence/display/IDP30/SAML2.SSO>" />
<ref bean="SAML2.ECP<https://wiki.shibboleth.net/confluence/display/IDP30/SAML2.ECP>" />
<ref bean="SAML2.Logout<https://wiki.shibboleth.net/confluence/display/IDP30/SAML2.Logout>" />
<ref bean="SAML2.AttributeQuery<https://wiki.shibboleth.net/confluence/display/IDP30/SAML2.AttributeQuery>" />
<ref bean="SAML2.ArtifactResolution<https://wiki.shibboleth.net/confluence/display/IDP30/SAML2.ArtifactResolution>" />
<ref bean="CAS.LoginConfiguration<https://wiki.shibboleth.net/confluence/display/IDP30/CAS.LoginConfiguration>" />
<ref bean="CAS.ProxyConfiguration<https://wiki.shibboleth.net/confluence/display/IDP30/CAS.ProxyConfiguration>" />
<ref bean="CAS.ValidateConfiguration<https://wiki.shibboleth.net/confluence/display/IDP30/CAS.ValidateConfiguration>" />
</list>
</property>
</bean>
I would proactively enable LDAP logging by setting idp.loglevel.ldap to ‘debug’ in your idp.properties file.
https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration
You should see output showing the authentication occur, a principal resolved and attributes populated.
Thanks,
Tom
From: users <users-bounces at shibboleth.net> On Behalf Of Melvin Lasky
Sent: Thursday, February 14, 2019 9:22 AM
To: users at shibboleth.net
Subject: Help setting up Shib's 3.4.3 Built-in CAS Server for Banner Apps
Hey everyone,
I’m new to Shibboleth and we are trying to abandon our Ellucian Ethos Identity and go straight Shibboleth [for many reasons].
We are using the docker container version of Shibboleth provided by Internet2 so that it’s all set up for InCommon Federation and everything. I have it successfully running on Google Kubernetes Engine, and I have a test SP running also on GKE and am able to log in and test it.
Now, on to the real stuff. We are a Banner institution. I would like to use Shibboleth’s built in CAS Server, however, I can’t seem to figure it out. Our UDC_IDENTIFIER is stored as employeeNumber in LDAP. I see that in attribute-resolver.xml
In my cas-protocol.xml I have this:
<bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
c:regex="https://([A-Za-z0-9_-]+\.)*manhattan\.edu(:\d+)?/.*<https://([A-Za-z0-9_-]+/.)*manhattan/.edu(:/d+)?/.*>"
p:group="manhattan-college"
p:authorizedToProxy="false" />
And I am able to log into let’s say a Banner 9 app. However, upon logging in I am greeted with this message:
System is configured for external authentication and identity assertion is null
So then I set up this RelyingPartyOverrides:
<bean id="shibboleth.regexRelyingParty" parent="RelyingParty" >
<property name="activationCondition" >
<bean class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" >
<constructor-arg name="pred" >
<bean class="com.google.common.base.Predicates" factory-method="or" >
<constructor-arg>
<util:list>
<bean class="com.google.common.base.Predicates" factory-method="containsPattern"
c:_0="https://ourappservers.*\.manhattan\.edu<https://ourappservers.*/.manhattan/.edu>/.*" />
</util:list>
</constructor-arg>
</bean>
</constructor-arg>
</bean>
</property>
<property name="profileConfigurations">
<list>
<ref bean="CAS.LoginConfiguration" />
<ref bean="CAS.ProxyConfiguration" />
<bean parent="CAS.ValidateConfiguration" p:userAttribute="employeeNumber" />
</list>
</property>
</bean>
Now I get:
HTTP Status 403 - No assertions found.
type Status report
message No assertions found.
description Access to the specified resource has been forbidden.
Also this is now in the logs:
shib-idp;idp-process.log;dev;nothing;2019-02-14 14:17:31,834 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception
shib-idp;idp-process.log;dev;nothing;java.lang.IllegalStateException: Principal cannot be null
shib-idp;idp-process.log;dev;nothing; at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)
shib-idp;idp-warn.log;dev;nothing;2019-02-14 14:17:31,834 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception
shib-idp;idp-warn.log;dev;nothing;java.lang.IllegalStateException: Principal cannot be null
shib-idp;idp-warn.log;dev;nothing; at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)
———————
I also have this in my attribute-filter.xml
<AttributeFilterPolicy id="releaseForBannerApps" >
<PolicyRequirementRule xsi:type="RequesterRegex" regex="https:\/\/ourappservers.*\.manhattan\.edu" />
<AttributeRule attributeID="employeeNumber">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
</AttributeFilterPolicy>
—————————————————————————————————————————
Also - our Banner App Servers are looking for the claim UDC_IDENTIFIER…. But I can change that to whatever if I have to. Or whatever I need.
Any suggestions on how we could get this to work would be awesome? I’m really at a loss.
I also don’t see my employeeNumber anywhere in the logs
Thank you for any help you can provide!
Have a great day!
Mel
Melvin Lasky
Associate Director of Enterprise Architecture
[cid:image001.jpg at 01D4C456.80804AF0]
Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu<mailto:melvin.lasky at manhattan.edu>
www.manhattan.edu<http://www.manhattan.edu/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190214/d1081e75/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 7478 bytes
Desc: image001.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20190214/d1081e75/attachment.jpg>
More information about the users
mailing list