CAS attributes and upstream SAML authentication

[Pierre SAGNE]

Hello,

I am trying to configure shibboleth IdP as a SAML to CAS proxy.

What I mean is that I want to provide CAS authentication to clients, and 
delegate authentication to another IdP using SAML.

My problem is that, when providing attributes to CAS, it works for 
attributes which come from my LDAP and static attributes, but not for 
attributes which I fetch from my upstream IdP.

The use case works fine when I send attributes from my upstream IdP to 
an OIDC client or to a SAML SP, but not to a CAS client.

I don't understand well the notion of "CAS proxy", so I don't know if 
that is what I should be using insteand of the classic "CAS server" mode.

Or is it just not supported for the CAS implementation of shibboleth IdP?

I understand that for OIDC, which also has a frontend then a backend 
interaction like CAS, you had to implement the encoding of attributes 
inside the tokens in order to be able to have them available at the 
backend phase, for those who come from upstream idp or HTTP headers in 
remote_user authentications.

And my guess is that this is what the CAS implementation lacks, or that 
I missed some configuration.

Best regards,

-- 
Pierre Sagne.