<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.hoenzb
{mso-style-name:hoenzb;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas",serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Update about our issue – the cas session was being disconnected by the IDP because the app server (weblogic) was using SSL V2.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Solved by adding these statements to weblogic startup:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoPlainText">-Dweblogic.security.SSL.protocolVersion=TLSv1<o:p></o:p></p>
<p class="MsoPlainText">-Dweblogic.security.SSL.minimumProtocolVersion=TLSv1<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Niva<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Jason Rotunno<br>
<b>Sent:</b> Tuesday, May 31, 2016 2:16 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Shib v3.2.1 cas-protocol authentication to BannerXe<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">It turns out this has nothing to do with CAS. I tried with a different user and it was successful. Apparently, for some users far fewer attributes are being returned from LDAP (attributes such as displayName, givenName, surname, email,
etc aren't coming back from AD despite being populated). No idea why but it's not a CAS or Banner issue.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Jason<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, May 31, 2016 at 11:44 AM, Jason Rotunno <<a href="mailto:jrotunno@swarthmore.edu" target="_blank">jrotunno@swarthmore.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, May 13, 2016 at 7:55 AM, Marvin Addison <<a href="mailto:marvin.addison@gmail.com" target="_blank">marvin.addison@gmail.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal">On Thu, May 12, 2016 at 1:50 PM Niva Agmon <<a href="mailto:nagmon@temple.edu" target="_blank">nagmon@temple.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Has anyone been able to successfully configure authentication to BannerXe (Banner9) using Shib v3.2.1 cas-protocol?<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal">I'm fairly certain we have successfully done this.<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We are getting access denied on the Banner side and it looks like the user is null.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal">I've seen a number of Banner/CAS integration problems and most of them are related to attribute release. You must ensure that the UDC_IDENTIFIER attribute is coming over the wire. Put the org.jasig.cas package in DEBUG and make sure you
see it in the ticket validation response.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
</div>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">We're attempting to get <span style="font-size:9.5pt">BEIS v8.3.2 working with Shibboleth/CAS v3.2 and s</span>ending the UDC_IDENTIFIER attribute with the correct value over the wire seems to be the issue we're having. The attribute is
in the ticket validation response but the Banner logs show the following:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">INFO [com.ellucian.sso.ssb.dao.impl.SessionInitDaoImpl.<initSession>] - Initializing a session for the Udc Id:ZERO_LENGTH_VALUE<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Likewise, the Shibboleth logs produce this:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedIdPAttributeImpl:220] - Attribute Definition 'UDC_IDENTIFIER': scripted attribute 'UDC_IDENTIFIER': recreated attribute contents are [EmptyAttributeValue{value=ZERO_LENGTH_VALUE}]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">When testing Shibboleth with the aacli.sh script, the correct value for UDC_IDENTIFIER is returned. When testing it with testshib, the shibd.log says that it's "skipping unmapped SAML 2.0 Attribute with Name: UDC_IDENTIFIER" but despite
that the logs show that it has the correct value.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">When authenticating with Banner via CAS, however, it seems to send the UDC_IDENTIFIER attribute with an empty value.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Unfortunately, I'm not particularly strong with Shibboleth or CAS and I'm learning this as I go along.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Any tips would be appreciated.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Jason<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><br clear="all">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#888888">-- <o:p></o:p></span></p>
<div>
<div>
<pre><span style="color:#888888">Jason Rotunno<o:p></o:p></span></pre>
<pre><span style="color:#888888">Systems Administrator<o:p></o:p></span></pre>
<pre><span style="color:#888888">Swarthmore College<o:p></o:p></span></pre>
<pre><span style="color:#888888">500 College Ave<o:p></o:p></span></pre>
<pre><span style="color:#888888">Swarthmore, PA 19081<o:p></o:p></span></pre>
<pre><span style="color:#888888">610.328.8505<o:p></o:p></span></pre>
<pre><span style="color:#888888"><o:p> </o:p></span></pre>
<pre><span style="color:#888888">IMPORTANT: Swarthmore College ITS staff will NEVER ask you for your<o:p></o:p></span></pre>
<pre><span style="color:#888888">password, including by email! Please keep your passwords private to<o:p></o:p></span></pre>
<pre><span style="color:#888888">protect yourself and the security of our network. <o:p></o:p></span></pre>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<pre>Jason Rotunno<o:p></o:p></pre>
<pre>Systems Administrator<o:p></o:p></pre>
<pre>Swarthmore College<o:p></o:p></pre>
<pre>500 College Ave<o:p></o:p></pre>
<pre>Swarthmore, PA 19081<o:p></o:p></pre>
<pre>610.328.8505<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>IMPORTANT: Swarthmore College ITS staff will NEVER ask you for your<o:p></o:p></pre>
<pre>password, including by email! Please keep your passwords private to<o:p></o:p></pre>
<pre>protect yourself and the security of our network. <o:p></o:p></pre>
</div>
</div>
</div>
</div>
</body>
</html>