<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Marvin, can you verify what version of Shibboleth you are using? I remember doing something like this a while back, but when I go to do the same in 3.1.2, the attributes are not returning. I tracked it down to `AttributeRequesterInEntityGroupPolicyRule.getEntityMetadata()` returning null (from the `AttributeFilterContext.requesterMetadataContextLookupStrategy.apply()` returning null).</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I’ve tried this in 3.1.1, an instance of 3.1.1 upgraded to 3.1.2, and a stock instance of 3.1.2. I can share my configuration if you think it might help. Thanks.</div> <br> <div id="bloop_sign_1439523034282469888" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-Jj</div></div> <br><p class="airmail_on" style="color:#000;">On August 13, 2015 at 14:58:06, Marvin Addison (<a href="mailto:marvin.addison@gmail.com">marvin.addison@gmail.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>We’re setting up IdP3 and want to release a set of attributes
to only users that login via CAS. Has anyone done this?</div>
</div>
</blockquote>
<div><br></div>
<div>Yes. Scott mentioned in another reply that SAML metadata
support is intended for the future, but there's a simple
CAS-specific metadata facility called "ServiceRegistry" that allows
you to create regular expressions for CAS services and assign them
to a metadata group. Following is an example from our institution
in conf/cas-protocol.xml:</div>
<div><br></div>
<div>
<div> <bean id="cas.serviceRegistry"</div>
<div>
class="net.shibboleth.idp.cas.service.PatternServiceRegistry"></div>
<div> <property
name="definitions"></div>
<div> <list></div>
<div>
<bean
class="net.shibboleth.idp.cas.service.ServiceDefinition"</div>
<div>
c:regex="https://([A-Za-z0-9_-]+\.)*vt\.edu(:\d+)?/.*"</div>
<div>
p:group="urn:mace:vt.edu:hokies"</div>
<div>
p:authorizedToProxy="false" /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
</div>
<div> </div>
<div>This puts all https services in our institutional domain in a
metadata group identified by the URN "urn:mace:vt.edu:hokies." Then
you can do a group-based metadata filter in
attribute-filter.xml:</div>
<div><br></div>
<div>
<div> <!-- Hokies release policy --></div>
<div> <AttributeFilterPolicy
id="releaseToHokies"></div>
<div> <PolicyRequirementRule
xsi:type="saml:InEntityGroup"</div>
<div>
groupID="urn:mace:vt.edu:hokies"/></div>
<div> <AttributeRule attributeID="uid"></div>
<div> <PermitValueRule xsi:type="basic:ANY"
/></div>
<div> </AttributeRule></div>
<div> </AttributeFilterPolicy></div>
</div>
<div><br></div>
<div>Please let me know if you have further questions.</div>
<div><br></div>
<div>M</div>
<div><br></div>
</div>
</div>
--
<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div></div></span></blockquote></body></html>