Help setting up Shib's 3.4.3 Built-in CAS Server for Banner Apps

[Tom O'Neill]

Melvin,

I would also suggest starting from the beginning and confirming your LDAP authentication and attribute configurations are working as expected.
To confirm that the logging updates worked – do you see other LDAP DEBUG messages in the log?

I know you said you have an SP setup – does that SP receive the expected attributes?

You should be able to get enough logging out of the IdP to indicate exactly what is happening.
Specifically, check out the ‘Logging Categories’ section which has an example for logging attribute data:
https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration#LoggingConfiguration-VariablesandProperties

net.shibboleth.idp.attribute

Messages related to attribute resolution and filtering


Thanks,
Tom

From: users <users-bounces at shibboleth.net> On Behalf Of Marvin Addison
Sent: Thursday, February 14, 2019 2:20 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Help setting up Shib's 3.4.3 Built-in CAS Server for Banner Apps

On Thu, Feb 14, 2019 at 2:10 PM Melvin Lasky <melvin.lasky at manhattan.edu<mailto:melvin.lasky at manhattan.edu>> wrote:
<AttributeFilterPolicy id="releaseForBannerApps" >
  <PolicyRequirementRule xsi:type="Requester" value="https://specific_banner_app_server.manhattan.edu" />

If you register services via the CAS service registry, then the relying party ID will be _exactly_ the value sent to the IdP in the "service" CAS protocol parameter. I suspect that's the problem here given that the URL above has no path or query parts. Look at the traffic between your Banner apps and Shib using your browser's developer console to capture the exact service URL that's getting sent to Shib, then update your attribute filter rule accordingly.

Hope that helps,
Marvin

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190214/ef4d6514/attachment.html>