<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks so much for your reply Marvin! <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Not sure how to put the org.jasig.cas package in DEBUG – I added a <logger name="org.jasig.cas" level="DEBUG"/> statement to logback.xml, but don’t really see
more info, so am probably missing some steps..<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I do have a small test website which is working fine with cas-protocol and the UDC_IDENTIFIER attribute is displayed in the ticket validation response. The Idp
cas setup is the same for both, the client on the test website is using mod_auth_cas and Banner is using the CAS grails springsecurity plugin.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Test site:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:45:26,981 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] - Attribute filtering engine 'ShibbolethAttributeFilter': 1
values for attribute 'UDC_IDENTIFIER' remained after filtering<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:45:26,981 - DEBUG [net.shibboleth.idp.cas.flow.impl.<span style="background:yellow;mso-highlight:yellow">PrepareTicketValidationResponseAction</span>:111]
- Processing IdPAttribute{<span style="background:yellow;mso-highlight:yellow">id=UDC_IDENTIFIER</span>, displayNames={}, displayDescriptions={}, encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML2StringAttributeEncoder@6911144], values=[<span style="background:yellow;mso-highlight:yellow">StringAttributeValue{value=B591Fxxxx84Exxx41EDED67xxxxxxxxxxxxx</span>}]}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:45:26,982 - INFO [Shibboleth-Audit.SSO:241] - 20160513T144526Z||487882949f58dc2208855ba5d772ffca3844a1a4e396e240928b4b39b4b61a86|https://np-fimsp.temple.edu/secure|https://www.apereo.org/cas/protocol/serviceValidate||||nagmon<span style="background:yellow;mso-highlight:yellow">||UDC_IDENTIFIER</span>|nagmon|ST-1463150726622-hIhVJp2RD0gj20n6CZgdXyZSI<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:45:26,982 - DEBUG [net.shibboleth.idp.cas.flow.impl.BuildSamlValidationSuccessMessageAction:90] - Building SAML response for https://xxx-xxx.temple.edu/secure
in IdP session 487882949f58dc2208855ba5d772ffca3844a1a4e396e240928b4b39b4b61a86<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">..<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">BannerXe authentication:<br>
<br>
2016-05-13 10:43:11,160 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'UDC_IDENTIFIER' remained after filtering<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:43:11,162 - DEBUG [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:89] - Granting service ticket for http://np-weblogic1.erp.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:43:11,162 - DEBUG [net.shibboleth.idp.cas.ticket.impl.SimpleTicketService:193] - Storing ST-1463150591162-Asf0z3JPr18I64zTpHGJQsIUW in context https://www.apereo.org/cas/protocol/login<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:43:11,165 - INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:100] - Granted service ticket for http://xxx-xxxx.erp.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-05-13 10:43:11,166 - INFO [Shibboleth-Audit.SSO:241] - 20160513T144311Z||487882949f58dc2208855ba5d772ffca3844a1a4e396e240928b4b39b4b61a86|http://xxx-xxxx.temple.edu:8180/StudentAdvisorSSB/j_spring_cas_security_check|https://www.apereo.org/cas/protocol/login||||nagmon|||nagmon|ST-1463150591162-Asf0z3JPr18I64zTpHGJQsIUW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Marvin Addison<br>
<b>Sent:</b> Friday, May 13, 2016 7:56 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Shib v3.2.1 cas-protocol authentication to BannerXe<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">On Thu, May 12, 2016 at 1:50 PM Niva Agmon <<a href="mailto:nagmon@temple.edu">nagmon@temple.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Has anyone been able to successfully configure authentication to BannerXe (Banner9) using Shib v3.2.1 cas-protocol?<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal">I'm fairly certain we have successfully done this.<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We are getting access denied on the Banner side and it looks like the user is null.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal">I've seen a number of Banner/CAS integration problems and most of them are related to attribute release. You must ensure that the UDC_IDENTIFIER attribute is coming over the wire. Put the org.jasig.cas package in DEBUG and make sure you
see it in the ticket validation response.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">M<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>