<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>We were getting the same principal back from CAS that we expected to use with Duo, so there was no mystery involved, no need to do anything special. Shibcas will set a principal itself. It looks almost identical to doing any other authentication + Duo
out of the box when configured.</p>
<p><br>
</p>
<p>The latest release of Shibcas works fine with 3.3.1 and does proper subject canonicalization. The biggest gotcha for me was that newer versions default to CAS 3.0.<br>
</p>
<p><br>
</p>
<p>I would imagine username transmutation would be possible at several points. It would just be gross at any one of them.<br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Justin Andrews <jandrews@uwf.edu><br>
<b>Sent:</b> Wednesday, August 9, 2017 7:52:00 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Shibcas + Duo</font>
<div> </div>
</div>
<div>
<div dir="ltr">Thank you Nate - for those using Shibcas & Duo within Shibboleth - how are you retrieving the value returned by CAS to pass onto Duo? Thank you!
<div><br>
</div>
<div><br>
</div>
<div>Scott has provided some guidance related to this below:</div>
<div><br>
</div>
<div><span style="font-size:12.8px">On 8/9/17, 8:39 AM, "users on behalf of Justin Andrews" <</span><a href="mailto:users-bounces@shibboleth.net" style="font-size:12.8px">users-bounces@shibboleth.net</a><span style="font-size:12.8px"> on behalf of </span><a href="mailto:jandrews@uwf.edu" style="font-size:12.8px">jandrews@uwf.edu</a><span style="font-size:12.8px">>
wrote:</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">> I guess I'm just wondering how I get that value being returned from Shibcas...</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">That isn't my code, so there's no way for me to answer that without looking at it.</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">I imagine it's inside the Subject produced by the flow in a Principal subclass of some sort. Results produced by flows are inside the active results collection attached to the MFA context.</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">> What function would pull it out of mfaCtx?</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">No single function could.</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">It seems to me you should perhaps ask its author to either update and certify it for use with 3.3 or dump it.</span><br style="font-size:12.8px">
<br style="font-size:12.8px">
<span style="font-size:12.8px">As a stand-alone feature, it is compatible with 3.3. As a part of the MFA subsystem that was added in 3.3, it's not.</span><br>
</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div><font face="arial, helvetica, sans-serif" style="background-color:rgb(255,255,255)" color="#000000" size="1">Justin Andrews<br>
</font></div>
<div><font face="arial, helvetica, sans-serif" style="background-color:rgb(255,255,255)" color="#000000" size="1">Enterprise Systems Integrator</font></div>
<div><span style="background-color:rgb(255,255,255)"><font face="arial, helvetica, sans-serif" color="#000000" size="1">Information Technology Services<br>
</font></span>
<div><font face="arial, helvetica, sans-serif" style="background-color:rgb(255,255,255)" color="#000000" size="1">University of West Florida</font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Mon, Aug 7, 2017 at 11:09 AM, Klingenstein, Nate <span dir="ltr">
<<a href="mailto:nklingenstein@calstate.edu" target="_blank">nklingenstein@calstate.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div id="m_6510569564609680337divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p>Justin,</p>
<p><br>
</p>
<p>Yes, several. I'd make sure you're using the latest libraries and the biggest gotcha I hit was some CAS servers that still don't support CAS 3.0. It was otherwise relatively straightforward.</p>
<p><br>
</p>
<p>You could ask specific questions here or of the Shibcas team directly, probably.</p>
<p><br>
</p>
<p>Hope this helps,</p>
<p>Nate.<br>
</p>
</div>
<hr style="display:inline-block;width:98%">
<div id="m_6510569564609680337divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Justin
Andrews <<a href="mailto:jandrews@uwf.edu" target="_blank">jandrews@uwf.edu</a>><br>
<b>Sent:</b> Monday, August 7, 2017 7:56:13 AM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
<b>Subject:</b> Shibcas + Duo</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hi folks - does anyone have a working IDP with Shibcas & Duo?
<div><br>
</div>
<div>Asking for a sanity check, thanks.<br>
<div><br clear="all">
<div>
<div class="m_6510569564609680337gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div><font face="arial, helvetica, sans-serif" style="background-color:rgb(255,255,255)" color="#000000" size="1">Justin Andrews<br>
</font></div>
<div><font face="arial, helvetica, sans-serif" style="background-color:rgb(255,255,255)" color="#000000" size="1">Enterprise Systems Integrator</font></div>
<div><span style="background-color:rgb(255,255,255)"><font face="arial, helvetica, sans-serif" color="#000000" size="1">Information Technology Services<br>
</font></span>
<div><font face="arial, helvetica, sans-serif" style="background-color:rgb(255,255,255)" color="#000000" size="1">University of West Florida</font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.<wbr>net</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>