<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Has anyone been able to successfully configure authentication to BannerXe (Banner9) using Shib v3.2.1 cas-protocol?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are getting access denied on the Banner side and it looks like the user is null. Any ideas/suggestions would be greatly appreciated!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is on the IdP side: <o:p></o:p></p>
<p class="MsoNormal">2016-05-11 16:46:35,781 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'cn' remained after filtering<o:p></o:p></p>
<p class="MsoNormal">2016-05-11 16:46:35,782 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'UDC_IDENTIFIER' remained after filtering<o:p></o:p></p>
<p class="MsoNormal">2016-05-11 16:46:35,807 - DEBUG [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:89] - Granting service ticket for
<a href="http://xxxxx.xx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check">
http://xxxxx.xx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check</a><o:p></o:p></p>
<p class="MsoNormal">2016-05-11 16:46:35,928 - DEBUG [net.shibboleth.idp.cas.ticket.impl.SimpleTicketService:193] - Storing ST-1462999595807-VHpzvkfuCxSNVFcMPpol3Ibrl in context
<a href="https://www.apereo.org/cas/protocol/login">https://www.apereo.org/cas/protocol/login</a><o:p></o:p></p>
<p class="MsoNormal">2016-05-11 16:46:35,930 - INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:100] - Granted service ticket for
<a href="http://xxxxx.xx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check">
http://xxxxx.xx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check</a><o:p></o:p></p>
<p class="MsoNormal">2016-05-11 16:46:35,940 - INFO [Shibboleth-Audit.SSO:241] - 20160511T204635Z||bfd9a017e03e91ecda8bf533d3aeac7477909d7ab329d9efb9fb7f82bf1aed5f|http://xxxxx.xx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check|https://www.apereo.org/cas/protocol/login||||fvtest12|||fvtest12|ST-1462999595807-VHpzvkfuCxSNVFcMPpol3Ibrl<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the Banner side:<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.443] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.validation.Saml11TicketValidationFilter - Attempting to validate ticket: ST-1462893945415-6Mof4ddkaado8VGsauPDjaFLy<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.443] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.util.CommonUtils - serviceUrl generated:
<a href="http://xxx.xxxx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check">
http://xxx.xxxx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check</a><o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.443] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.validation.Saml11TicketValidator - Placing URL parameters in map.<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.443] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.validation.Saml11TicketValidator - Calling template URL attribute map.<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.443] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.validation.Saml11TicketValidator - Loading custom parameters from configuration.<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.444] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.validation.Saml11TicketValidator - Constructing validation url:
<a href="https://np-fim2.temple.edu/idp/profile/cas/samlValidate?TARGET=http%3A%2F%2Fxxx.xxxx.temple.edu%3A8180%2FStudentAdvisorSSB%2Fj_spring_cas_security_check">
https://np-fim2.temple.edu/idp/profile/cas/samlValidate?TARGET=http%3A%2F%2Fxxx.xxxx.temple.edu%3A8180%2FStudentAdvisorSSB%2Fj_spring_cas_security_check</a><o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.444] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.jasig.cas.client.validation.Saml11TicketValidator - Retrieving response from server.<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - Converted URL to lowercase, from: '/j_spring_cas_security_check';
to: '/j_spring_cas_security_check'<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - Candidate is: '/j_spring_cas_security_check'; pattern is /**/api/**;
matched=false<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - Converted URL to lowercase, from: '/j_spring_cas_security_check';
to: '/j_spring_cas_security_check'<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - Candidate is: '/j_spring_cas_security_check'; pattern is /**/qapi/**;
matched=false<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - Converted URL to lowercase, from: '/j_spring_cas_security_check';
to: '/j_spring_cas_security_check'<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - Candidate is: '/j_spring_cas_security_check'; pattern is /**;
matched=true<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.FilterChainProxy - /j_spring_cas_security_check?ticket=ST-1462893945415-6Mof4ddkaado8VGsauPDjaFLy
at position 1 of 9 in additional filter chain; firing Filter: 'org.springframework.security.web.context.SecurityContextPersistenceFilter@22e1f574'<o:p></o:p></p>
<p class="MsoNormal">[Tue, 10-May-2016 @ 11:25:45.485] [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository - HttpSession returned null object for
SPRING_SECURITY_CONTEXT<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Niva <o:p></o:p></p>
<p class="MsoNormal"><a href="mailto:nagmon@temple.edu">nagmon@temple.edu</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>