CAS Shib plugin, how to have shib release CAS released attributes

[Michael Grady]

> On May 30, 2023, at 7:10 PM, Cantor, Scott via users <users at shibboleth.net> wrote:
> 
>> Sorry, to clarify, CAS is releasing attributes. I see them when using a CAS client.
>> In Shib I can resolve attributes from db, ldap, webservice, etc and setup filters to
>> send back to the application. I'm trying to figure out how to resolve the
>> attributes that sent back from CAS after a successful login via the Shib/CAS
>> plugin.
> 
> Don't know what the plugin does. I know what it's meant to be doing if it's using the API properly, which would be to surface them so they're added into the Java Subject, and we have a connector and definition for accessing the Subject.
> 
> -- Scott
> 

As the README for that plugin states:  "Also, please do note that the Shibboleth IdP v3x+ has support for the CAS protocol and Apereo CAS server v5+ also has support for the SAML2 protocol. Unless justified otherwise, a better approach long-term would be to consolidate down to one platform removing the need to deploy and configure this plugin."

If you, for whatever reasons, want to continue to run both, you can delegate authentication to the CAS Server using the SAMLv2 protocol, there is no advantage to still doing it with the CAS protocol. And if the CAS Server is "old enough" that it doesn't support the SAMLv2 protocol, then that is a CAS Server version that you really don't want to still be running.

Because both products support both protocols (for quite some time now), and because one can still delegate to a CAS Server but use the SAMLv2 protocol instead, Unicon has not extended the Shib-CAS-Authn plugin to support pulling attributes out of the CAS response and making them available to the Shib IdP. It is not work that seemed to make sense to do.

--
Michael A. Grady
IAM Architect, Unicon, Inc.