<div dir="ltr"><div class="gmail_default" style="font-family:"courier new",monospace">We did get it to work but it's very custom, we had to create the following resolver which is released only to Banner:</div><div class="gmail_default" style="font-family:"courier new",monospace"><br></div><div class="gmail_default" style="font-family:"courier new",monospace"><div class="gmail_default"> <!-- Used by Banner XE --></div><div class="gmail_default"> <resolver:AttributeDefinition</div><div class="gmail_default"> id="bannerUdcIdentifier"</div><div class="gmail_default"> xsi:type="ad:Simple"</div><div class="gmail_default"> sourceAttributeID="uid"></div><div class="gmail_default"> <resolver:Dependency</div><div class="gmail_default"> ref="ldapSource" /></div><div class="gmail_default"> <resolver:AttributeEncoder</div><div class="gmail_default"> xsi:type="enc:SAML2String"</div><div class="gmail_default"> name="UDC_IDENTIFIER" /></div><div class="gmail_default"> </resolver:AttributeDefinition></div><div><br></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><font face="monospace, monospace">Jeffrey E. Crawford<br>Enterprise Service Team<a href="mailto:jeffreyc@ucsc.edu" target="_blank"></a></font><div><font face="monospace, monospace"> ^ ^</font></div><div><font face="monospace, monospace"> / \ ^ / \ ^</font></div><div><font face="monospace, monospace"> / \/ \ / \ / \</font></div><div><font face="monospace, monospace"> / \/ \/ \</font></div><div><font face="monospace, monospace">/ \</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">You have been assigned this mountain to prove to others that it *can* be moved.</font></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Nov 1, 2017 at 9:10 AM, O'Dowd, Josh <span dir="ltr"><<a href="mailto:Josh.O'Dowd@mso.umt.edu" target="_blank">Josh.O'Dowd@mso.umt.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">FWIW, we have come to the same conclusions(stick with CAS) with all of the Banner components EXCEPT for the newer Banner XE modules that began delivering in 2012. Those modules are built on the Grails platform where there are already spring security plugins developed for SAML2 implementation. Ellucian granted us permission to fully explore those plugins while they develop their own, without violating our support contract, and we have successfully implemented SAML2 for BannerXE. Again, we never got there with the legacy Banner versions/modules.<br>
<span class="HOEnZb"><font color="#888888"><br>
Josh O'Dowd<br>
University of Montana<br>
</font></span><span class="im HOEnZb"><br>
-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>] On Behalf Of Tom O'Neill<br>
Sent: Tuesday, October 31, 2017 6:22 PM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
</span><div class="HOEnZb"><div class="h5">Subject: RE: Banner 9 SAML<br>
<br>
Hi All,<br>
<br>
I've also run in to issues with SAML 2.0 integration for some of the Ellucian Banner 9 components, even when using their Ellucian Ethos Identity solution as the IdP.<br>
Until the SAML 2.0 support is more mature, I'm suggesting the continued use of CAS, whenever possible.<br>
<br>
Thanks,<br>
<br>
Tom O'Neill<br>
<br>
-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>] On Behalf Of Cantor, Scott<br>
Sent: Friday, October 27, 2017 5:15 PM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
Subject: Re: Banner 9 SAML<br>
<br>
On 10/27/17, 4:01 PM, "users on behalf of Jorj Bauer" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:jorj@temple.edu">jorj@temple.edu</a>> wrote:<br>
<br>
> The problem is mostly avoidable with CAS<br>
<br>
Plenty of browsers will break with any use of iframes and you should assume any such use is impossible with this software. That is going to be increasingly true and is already mostly true. That applies to CAS or SAML.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div>