Attributes for CAS?

[Paul B. Henson]

On Wed, Jul 09, 2025 at 02:58:25PM -1000, Baron Fujimoto via users wrote:
> Shibboleth (CAS is currently being handled via Apereo CAS). With
> Shibboleth, how do you specify the set of attributes released by
> /serviceValidate or /samlValidate? I didn't find this obvious anywhere
> under the CasProtocolConfiguration wiki hierarchy.

If you use the xml interface for defining CAS metadata, eg:

  <EntityDescriptor entityID="https://icinga.unx.cpp.edu/">
    <SPSSODescriptor
protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
      <AssertionConsumerService
Binding="https://www.apereo.org/cas/protocol/login"
                                Location="https://icinga.unx.cpp.edu/"
                                index="1"/>
    </SPSSODescriptor>
  </EntityDescriptor>

You release them the same way you do SAML ones, either explicitly for
that entity id:

<AttributeFilterPolicy id="example">
    <PolicyRequirementRule xsi:type="Requester"
       value="https://icinga.unx.cpp.edu/" />

or by tagging the metadata:

        <MetadataFilter xsi:type="EntityAttributes">
          <saml:Attribute
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                          Name="http://shibboleth.net/ns/attributes/releaseAllValues"
                          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue>memberOf</saml:AttributeValue>
          </saml:Attribute>
          <Entity>https://icinga.unx.cpp.edu/</Entity>
        </MetadataFilter>

and releasing by tag:

  <AttributeFilterPolicy id="memberof_by_tag">
    <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
                           attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
                           attributeValue="memberOf" />
    <AttributeRule permitAny="true" attributeID="memberOf" />
  </AttributeFilterPolicy>

or any other documented mechanism.

If you're just starting with CAS in the idp, I'd advise using the SAML
compatible metatdata rather than the legacy CASServiceRegistry. That
allows you to just treat CAS services basically the same as SAML ones,
as least for attribute release purposes.