Attributes for CAS?

[Baron Fujimoto]

We're attempting to unify our separate SAML and CAS SSO services under
Shibboleth (CAS is currently being handled via Apereo CAS). With
Shibboleth, how do you specify the set of attributes released by
/serviceValidate or /samlValidate? I didn't find this obvious anywhere
under the CasProtocolConfiguration wiki hierarchy.

On the slack channel, it was suggested to use groups, as with the following
service registration

<bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
    c:regex="^http(s|)://xxxxxxxxxxxxxx/.*"
    p:group="CASApps"
    p:singleLogoutParticipant="false"
    p:authorizedToProxy="false"/>

and attribute filter

<AttributeFilterPolicy id='releaseForCasUidGroup'>
    <PolicyRequirementRule xsi:type="OR">
        <Rule xsi:type="InEntityGroup" groupID="CASApps" />
        <Rule xsi:type="InEntityGroup" groupID="CASApexApps" />
    </PolicyRequirementRule>
        <AttributeRule attributeID='uid'>
            <PermitValueRule xsi:type='ANY' />
        </AttributeRule>
</AttributeFilterPolicy>

Is this the best practice? I note that the CASServiceRegistry reference
provides the p:group example that this configuration uses. And if I look
for more information on using groups, I find the following doc for
InEntityGroupConfiguration, but that page seems to recommend instead the
use of AffiliationDescriptorand I haven't yet found good source  on how you
might do this or whether it's not actually applicable for CAS (and why).

We have over 1K CAS service registrations we'll have to migrate.

-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250709/51c3b07e/attachment.htm>