CAS Encoded Ticket & CAS User

[Ryan Rumbaugh]

Thanks Marvin, that was exactly the info I needed. 

--
Ryan Rumbaugh

On 1/21/19, 8:49 AM, "users on behalf of Marvin Addison" <users-bounces at shibboleth.net on behalf of serac at vt.edu> wrote:

    On Fri, Jan 18, 2019 at 4:42 PM Ryan Rumbaugh <rrumbaugh at nebraska.edu> wrote:
    > I guess the crux of my question is, how can a CAS application know the username with the backchannel call on serviceValidate
    
    A CAS ServiceTicket has the same fields as Ticket [1], which includes
    a reference to the authenticated principal produced by the subject
    canonicalization flow. The value of the "cas:user" attribute in the
    protocol response has only an indirect relationship to the principal.
    The attribute resolver flow runs at service ticket validation time,
    and the "userAttribute" configuration directive indicates which of the
    resolved attributes to use as the username in the service ticket
    validation response. The principal is typically an argument to the
    resolver data source plugins, thus the indirect relationship.
    
    Best,
    Marvin
    
    [1] https://urldefense.proofpoint.com/v2/url?u=https-3A__build.shibboleth.net_nexus_content_sites_site_java-2Didentity-2Dprovider_3.4.3_apidocs_net_shibboleth_idp_cas_ticket_Ticket.html&d=DwICAg&c=Cu5g146wZdoqVuKpTNsYHeFX_rg6kWhlkLF8Eft-wwo&r=x_uM7qpgXzh_70B3Dgey5pfdCFAWMhq-IedVFyaAIwg&m=M61RtveUjSiyEWWCCpcN7EKjH8vffCDWZlbm5s8EbAE&s=nIfYcgO7DTP4rYRX1w4ciIeGpxDsH7sJaawszfsg3vM&e=
    -- 
    For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=Cu5g146wZdoqVuKpTNsYHeFX_rg6kWhlkLF8Eft-wwo&r=x_uM7qpgXzh_70B3Dgey5pfdCFAWMhq-IedVFyaAIwg&m=M61RtveUjSiyEWWCCpcN7EKjH8vffCDWZlbm5s8EbAE&s=g3NXCOmNntpg07-GSW1spmFds18N7qOM7PoULgMFue8&e=
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net