<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 1/3/18 9:44 AM, Andrew Morgan wrote:<br>
</div>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1801030941050.32369@shell.onid.oregonstate.edu">On
Tue, 2 Jan 2018, Dan Malone wrote:
<br>
<br>
<blockquote type="cite">We are looking for a way to simplify the
configuration of our CAS services.
<br>
In our current CAS usage, we are not doing any additional
attribute release, only username.
<br>
<br>
From what we can tell, to enable a CAS client, at a minimum we
need to do two things:
<br>
<br>
1. add the service URL in the cas.serviceRegistry bean in
cas-protocol.xml
<br>
2. release the username attribute in attribute-filter.xml
<br>
<br>
To make it easier to add new services, we would like to be able
to add the service in once place.
<br>
<br>
For option A, we add a very permissive wildcard to
cas-protocol.xml and control services using
attribute-filter.xml. We got this to work, but when you have an
unauthorized service, a ticket is granted and the failure is not
noticed until the verification step. Neither the user or the
service knows why because the ticket was issued.
<br>
<br>
For option B, we would like to use cas-protocol.xml to limit the
services and in attribute-filter.xml, release username to all
CAS services. This provides the user friendly message
"...application you have accessed is not registered..." similar
to pre-shib CAS. However, we can not use the very permissive
wildcard in attribute-filter.xml, because this would also
release via SAML to all entities in, for example, the InCommon
metadata, and our campus is not ready to release to R&S,
much less the whole aggregate. (Yes, we're working on the
R&S release)
<br>
<br>
So, here's my question:
<br>
<br>
How do we release an attribute to all services defined in the
cas.serviceRegistry bean list?
<br>
</blockquote>
<br>
Define your services in cas-protocol.xml with a p:group="foo"
property, like this:
<br>
<br>
<bean
class="net.shibboleth.idp.cas.service.ServiceDefinition"
<br>
c:regex=<a class="moz-txt-link-rfc2396E" href="https://your-service\.example\.edu">"https://your-service\.example\.edu"</a>
<br>
p:group="standard-attributes"
<br>
p:authorizedToProxy="false"
<br>
p:singleLogoutParticipant="false" />
<br>
<br>
Then configure attribute release for that group in
attribute-filter.xml:
<br>
<br>
<AttributeFilterPolicy id="cas-standard-attributes">
<br>
<PolicyRequirementRule xsi:type="OR">
<br>
<Rule xsi:type="InEntityGroup"
groupID="standard-attributes" />
<br>
</PolicyRequirementRule>
<br>
<AttributeRule attributeID="uid">
<br>
<PermitValueRule xsi:type="ANY"/>
<br>
</AttributeRule>
<br>
</AttributeFilterPolicy>
<br>
<br>
<br>
When you add a new service to cas-protocol.xml, make sure you
include the p:group property.
<br>
<br>
Andy
<br>
<div class="moz-txt-sig"><span class="moz-txt-tag">-- <br>
</span>For Consortium Member technical support, see
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/x/coFAAg">https://wiki.shibboleth.net/confluence/x/coFAAg</a>
<br>
To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
<br>
</div>
</blockquote>
This is great and is working with the small tests I've done today.<br>
Thanks!<br>
<br>
I found this:
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration</a><br>
<blockquote>The fields of ServiceDefinition are straightforward:<br>
...<br>
2. group - human-readable name of the group of services<br>
...<br>
</blockquote>
<br>
It did not occur to me that this group was equivalent to an
EntityGroup.<br>
Is this documented somewhere else or should this be obvious if I
understood the beans better?<br>
<br>
Thanks,<br>
Dan<br>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title></title>
Dan Malone<br>
<font color="#999999">Lead Identity Management Architect<br>
Information Technology Services<br>
California Polytechnic State University<br>
San Luis Obispo, California<br>
<br>
Direct 805-756-6326<br>
<a class="moz-txt-link-abbreviated" href="mailto:dmalone@calpoly.edu">dmalone@calpoly.edu</a></font><br>
</div>
</body>
</html>