CAS Shib plugin, how to have shib release CAS released attributes

[Pablo Vidaurri]

Thanks for the feedback. We were running an old version of CAS and upgraded
within the last 18 months. We also had intentions on consolidating
platforms and use CAS with its out of the box Shibboleth. The problem was
getting Saml2 applications to migrate to the new idp for cas and having to
publish new idp metadata. I recall we even had issues with doing redirects
as a workaround from old shib url to new shib url.

I will add a consolidation task to my back log.

Thanks.
-psv

On Tue, May 30, 2023 at 7:35 PM Michael Grady <mgrady at unicon.net> wrote:

>
> > On May 30, 2023, at 7:10 PM, Cantor, Scott via users <
> users at shibboleth.net> wrote:
> >
> >> Sorry, to clarify, CAS is releasing attributes. I see them when using a
> CAS client.
> >> In Shib I can resolve attributes from db, ldap, webservice, etc and
> setup filters to
> >> send back to the application. I'm trying to figure out how to resolve
> the
> >> attributes that sent back from CAS after a successful login via the
> Shib/CAS
> >> plugin.
> >
> > Don't know what the plugin does. I know what it's meant to be doing if
> it's using the API properly, which would be to surface them so they're
> added into the Java Subject, and we have a connector and definition for
> accessing the Subject.
> >
> > -- Scott
> >
>
> As the README for that plugin states:  "Also, please do note that the
> Shibboleth IdP v3x+ has support for the CAS protocol and Apereo CAS server
> v5+ also has support for the SAML2 protocol. Unless justified otherwise, a
> better approach long-term would be to consolidate down to one platform
> removing the need to deploy and configure this plugin."
>
> If you, for whatever reasons, want to continue to run both, you can
> delegate authentication to the CAS Server using the SAMLv2 protocol, there
> is no advantage to still doing it with the CAS protocol. And if the CAS
> Server is "old enough" that it doesn't support the SAMLv2 protocol, then
> that is a CAS Server version that you really don't want to still be running.
>
> Because both products support both protocols (for quite some time now),
> and because one can still delegate to a CAS Server but use the SAMLv2
> protocol instead, Unicon has not extended the Shib-CAS-Authn plugin to
> support pulling attributes out of the CAS response and making them
> available to the Shib IdP. It is not work that seemed to make sense to do.
>
> --
> Michael A. Grady
> IAM Architect, Unicon, Inc.
>
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230530/1f98883f/attachment.htm>