Help setting up Shib's 3.4.3 Built-in CAS Server for Banner Apps

[Craig Pluchinsky]

I figured I'd add our configs to this thread since we have Banner 9 
working in production with Self Service, Admin and Registration.  We are 
using the CAS protocol built in to the IDP.  Using the hazelcast storage 
backend.  Couple things I remember is some apps do something 
with samlValidate so you need an atribute UDC_IDENTIFIER.  Also the latest 
IDP changed the ticket service stuff and that may not work with banner9. 
I think it didn't for us so I went back to simpleTicketService.  Hope this 
helps.  Feel free to reach out with questions.

~cas-protocol.xml~
     <bean id="reloadableServiceRegistry"

class="%{idp.cas.serviceRegistryClass:net.shibboleth.idp.cas.service.PatternServiceRegistry}">
         <property name="definitions">
             <list>
                 <bean 
class="net.shibboleth.idp.cas.service.ServiceDefinition"
                       c:regex="https:YOUR_REGEX*"
                       p:group="cas-services"
                       p:authorizedToProxy="false" />
             </list>
         </property>
     </bean>

    <alias name="simpleTicketService" alias="shibboleth.CASTicketService" 
/>

~attribute-resolver.xml~
     <!-- UDC_IDENTIFIER -->
     <AttributeDefinition xsi:type="Simple" id="UDC_IDENTIFIER">
         <InputDataConnector ref="myLDAP" attributeNames="cn" />
         <AttributeEncoder xsi:type="SAML1String" 
name="urn:mace:iup.edu:shibboleth:attribute-def:UDC_IDENTIFIER" 
encodeType="false" />
         <AttributeEncoder xsi:type="SAML2String" 
name="urn:mace:iup.edu:shibboleth:attribute-def:UDC_IDENTIFIER" 
friendlyName="uid" encodeType="false" />
     </AttributeDefinition>

~attribute-filter.xml~
     <AttributeFilterPolicy id="CASEntities">
         <PolicyRequirementRule xsi:type="InEntityGroup" 
groupID="cas-services"/>

         <AttributeRule attributeID="UDC_IDENTIFIER">
             <PermitValueRule xsi:type="ANY"/>
         </AttributeRule>
     </AttributeFilterPolicy>

~relying-party.xml~
     <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
         <property name="profileConfigurations">
             <list>
                 <bean parent="Shibboleth.SSO" 
p:includeAttributeStatement="true"  />
                 <bean parent="SAML2.SSO"  />
                 <ref bean="CAS.LoginConfiguration" />
                 <ref bean="CAS.ValidateConfiguration" />
             </list>
         </property>
     </bean>



-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Thu, 14 Feb 2019, IAM David Bantz wrote:

> Bradley, I and I suspect many others would appreciate details of your config on both the Banner and Sibb side.
> David Bantz
> U Alaska
> 
> On Thu, Feb 14, 2019 at 12:34 PM Mathis, Bradley <bmathis at pima.edu> wrote:
>       Hi Melvin,    I responded earlier but perhaps you didn't get the email.   I'm running banner9 apps in a
>       couple of test environments with idp 3.x and would be happy to try and help.  You can contact me directly
>       via email or phone ....that way we could get as "Bannery" as needed .... with the little bit of information
>       you have given already I see a couple things that could be setup incorrectly.  I'm not a shibboleth expert
>       or developer as many here are ... but I am knowledgeable about Banner9 configurations and I do have it
>       working (albeit mine in setup for DUO/MFA).  Anyway just offering since I'm familiar what you are trying to
>       do.
> Thanks!
> 
> Brad Mathis
> Principal Systems Analyst
> Pima Community College
> IT - Technical Services
> 520.206.4826
> bmathis at pima.edu
> 
> [uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download]
> 
> 
> 
> 
> 
> 
> 
> On Thu, Feb 14, 2019 at 12:09 PM Melvin Lasky <melvin.lasky at manhattan.edu> wrote:
>       Hey guys, Thanks for all the responses! 
> 
> I put the LDAP Debug in, and I do see my employeeNumber in my logs.
> 
> I changed my App to look for employeeNumber instead of UDC_IDENTIFIER to make it slightly easier. I also
> changed my attribute-filter.xml to look for one thing.
> 
> Still no dice. 
> 
> <AttributeFilterPolicy id="releaseForBannerApps" >
>   <PolicyRequirementRule xsi:type="Requester" value="https://specific_banner_app_server.manhattan.edu" />
>         <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
>         <AttributeRule attributeID="employeeType" permitAny="true" />
>         <AttributeRule attributeID="surname" permitAny="true" />
>         <AttributeRule attributeID="givenName" permitAny="true" />
>         <AttributeRule attributeID="mail" permitAny="true" />
>         <AttributeRule attributeID="employeeNumber" permitAny="true" />
>         <AttributeRule attributeID="UDC_IDENTIFIER" permitAny="true" />
> </AttributeFilterPolicy>
> 
> ——
> 
> Still nothing.
> 
> Any suggestions would  be amazing.
> 
> Thanks
> 
> Melvin Lasky
> Associate Director of Enterprise Architecture
> 
> [IMAGE]
> 
> 
> Riverdale, NY 10471
> Phone: 718-862-7410
> melvin.lasky at manhattan.edu
> www.manhattan.edu
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
>