Shibboleth IdP 4.0 and Shibcas Plugin

[Matt Elson]

> The later CAS servers supports SAML, so it probably makes more sense to just implement proxying between the two with SAML to avoid unnecessary third-party code. But then you already noted "change how you do it" is the point of asking the question.
> 
> There is one small area of complexity to getting proxying to work, but in other respects it is not a feature that is as complex to use as you might expect it to be. That surprises me more than anyone.
> 
> -- Scott

So whipped this up in test (for anyone else investigating this route, 
the only real headscratcher I hit was having to disable checkAddress for 
the CAS IDP entity since CAS sets SubjectLocality to the CAS server 
itself and thus fails checkAddress validation) and seems to be working 
smoothly.

However, haven't quite figured out how to implement a few features of 
ShibCAS we made use for so revealing my laziness to the world and asking 
for hints or at least if I'm on the right track.

One feature was the ability to send the entityID of the initail SP over 
via ShibCAS and let CAS make decisions based on it (such as whether or 
not to trigger Duo, for example). Looking at how the proxying works, am 
I correct in saying that the best solution under authn/SAML would be to 
configure the Shibboleth IDP to make this decision instead? (Doesn't 
seem like the initial SP's entityID is even passed up to CAS.)

The second related feature was ShibCAS's handling of requests for 
"https://refeds.org/profile/mfa" (basically it would go to CAS with a 
magic parameter to trigger mfa and then make sure to return the correct 
context to the SP). While it's easy enough for me to setup authn/SAML to 
pass releveant profile and even have CAS trigger Duo accordingly, CAS's 
IDP doesn't return the proper AuthnContext (looking at CAS config 
options, there doesn't seem to be a way to have it do so dynamically).

I'm leaning towards handling this in Shibboleth directly, but it seems 
like another option could be to configure Shibboleth in some fashion so 
that it reads/parses the assertion returned from CAS and updates the 
AuthnContext when appropriate. (That said, I assume I'd have to do 
something quite custom to pull that off and that my effort would be 
better directed towards learning to Duo-in-Shib, especially since the 
future plan is to eventually consolidate platforms anyway).

Apologies for likely butchery of terminology and thanks in advance for 
any help anyone can give.

Matt