<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I’ve hit a block and would like to see if others might be able to point me in the right direction. On a IDP 3.3.2 setup with a CAS configuration setup to release a different attribute as the name-identifier,
I see log entries that show it going through the process but the payload itself doesn’t have the said attribute value as the nameid, but instead, has the login id. Here’s an example output with debugging:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,359 - DEBUG [net.shibboleth.idp.cas.flow.impl.UpdateIdPSessionWithSPSessionAction:104] - Created SP session CASSPSession: https://bnrxedevh.neu.edu/applicationNavigator/j_spring_cas_security_check
via ST-1523560493949-39d7YFB7AJokyxeoqtDwFOe3u<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,360 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:433] - Ignoring SPSession add, session manager is not configured to track them<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">This line indicates to me that the relaying party config to override the CAS username is triggered for this end-point:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,360 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:88] - Using neuEduNUID for CAS username<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The following shows the attributes and values (some sanitized for privacy), with the attribute name/value being: neuEduNUID=MYNUID:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,360 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107] - Processing IdPAttribute{id=commonName, displayNames={}, displayDescriptions={}, encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML1StringAttributeEncoder@355ef6be,
net.shibboleth.idp.saml.attribute.encoding.impl.SAML2StringAttributeEncoder@d1644fc9], values=[StringAttributeValue{value=David Mak}]}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,361 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107] - Processing IdPAttribute{id=eduPersonScopedAffiliation, displayNames={}, displayDescriptions={},
encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML2StringAttributeEncoder@23ac74, net.shibboleth.idp.saml.attribute.encoding.impl.SAML1StringAttributeEncoder@bab64ea8], values=[StringAttributeValue{value=staff@neu.edu}, StringAttributeValue{value=member@neu.edu}]}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,361 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107] - Processing IdPAttribute{id=UDC_IDENTIFIER, displayNames={}, displayDescriptions={}, encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML2StringAttributeEncoder@8c4162f2,
net.shibboleth.idp.saml.attribute.encoding.impl.SAML1StringAttributeEncoder@27b56b59], values=[StringAttributeValue{value=UDCIDVALUE}]}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,361 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107] - Processing IdPAttribute{id=neuEduNUID, displayNames={}, displayDescriptions={}, encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML1StringAttributeEncoder@44856ed,
net.shibboleth.idp.saml.attribute.encoding.impl.SAML2StringAttributeEncoder@fb415ce], values=[StringAttributeValue{value=MYNUID}]}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,361 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:107] - Processing IdPAttribute{id=eduPersonPrincipalName, displayNames={}, displayDescriptions={}, encoders=[net.shibboleth.idp.saml.attribute.encoding.impl.SAML2ScopedStringAttributeEncoder@23a131,
net.shibboleth.idp.saml.attribute.encoding.impl.SAML1ScopedStringAttributeEncoder@5625d981], values=[ScopedStringAttributeValue{value=MYNUID, scope=neu.edu}]}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,362 - INFO [Shibboleth-Audit.SSO:275] - 20180412T191454Z|||https://bnrxedevh.neu.edu/applicationNavigator/j_spring_cas_security_check|https://www.apereo.org/cas/protocol/serviceValidate||||MYLOGINID||commonName,eduPersonScopedAffiliation,UDC_IDENTIFIER,neuEduNUID,eduPersonPrincipalName|MYLOGINID|ST-1523560493949-39d7YFB7AJokyxeoqtDwFOe3u|<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here's the payload:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,362 - DEBUG [net.shibboleth.idp.cas.flow.impl.BuildSamlValidationSuccessMessageAction:113] - Building SAML response for https://bnrxedevh.neu.edu/applicationNavigator/j_spring_cas_security_check
in IdP session 8c42f2c1790bae2cc80fc0c8920a2c48ac006c6d327ab71f0e0f622405ef3260<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,364 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2018-04-12 15:14:54,368 - DEBUG [PROTOCOL_MESSAGE:70] -
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><?xml version="1.0" encoding="UTF-8"?><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <SOAP-ENV:Body><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1p:Response IssueInstant="2018-04-12T19:14:54.362Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> MajorVersion="1" MinorVersion="1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ResponseID="ST-1523560493949-39d7YFB7AJokyxeoqtDwFOe3u" xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1p:Status><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1p:StatusCode Value="saml1p:Success"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1p:Status><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Assertion<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> AssertionID="_753381667db3444d73b6c09981d00952"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> IssueInstant="2018-04-12T19:14:54.362Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Issuer="https://neuidmssodev.neu.edu/idp/shibboleth"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> MajorVersion="1" MinorVersion="1" xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Conditions NotBefore="2018-04-12T19:14:54.362Z" NotOnOrAfter="2018-04-12T19:15:54.362Z"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AudienceRestrictionCondition><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Audience>https://bnrxedevh.neu.edu/applicationNavigator/j_spring_cas_security_check</saml1:Audience><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:AudienceRestrictionCondition><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Conditions><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AuthenticationStatement<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> AuthenticationInstant="2018-04-12T19:14:54.362Z" AuthenticationMethod="authn/MFA"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Subject><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:NameIdentifier>MYLOGINID</saml1:NameIdentifier><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:SubjectConfirmation><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:artifact</saml1:ConfirmationMethod><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:SubjectConfirmation><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Subject><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:AuthenticationStatement><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeStatement><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Subject><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:NameIdentifier>MYLOGINID</saml1:NameIdentifier><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:SubjectConfirmation><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:artifact</saml1:ConfirmationMethod><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:SubjectConfirmation><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Subject><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Attribute AttributeName="commonName" AttributeNamespace="http://www.ja-sig.org/products/cas/"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeValue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsd="http://www.w3.org/2001/XMLSchema"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">David Mak</saml1:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Attribute<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> AttributeName="eduPersonScopedAffiliation" AttributeNamespace="http://www.ja-sig.org/products/cas/"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeValue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsd="http://www.w3.org/2001/XMLSchema"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">staff@neu.edu</saml1:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeValue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsd="http://www.w3.org/2001/XMLSchema"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">member@neu.edu</saml1:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Attribute AttributeName="UDC_IDENTIFIER" AttributeNamespace="http://www.ja-sig.org/products/cas/"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeValue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsd="http://www.w3.org/2001/XMLSchema"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">EEE3939EB1DA663B727990E33CDE7F1A</saml1:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Attribute AttributeName="neuEduNUID" AttributeNamespace="http://www.ja-sig.org/products/cas/"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeValue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsd="http://www.w3.org/2001/XMLSchema"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">MYNUID</saml1:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:Attribute<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> AttributeName="eduPersonPrincipalName" AttributeNamespace="http://www.ja-sig.org/products/cas/"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <saml1:AttributeValue<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsd="http://www.w3.org/2001/XMLSchema"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">MYNUID</saml1:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:AttributeStatement><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1:Assertion><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </saml1p:Response><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </SOAP-ENV:Body><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"></SOAP-ENV:Envelope><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">This is the saml-nameid.xml snippet for that attribute:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <util:list id="shibboleth.SAML1NameIdentifierGenerators"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <ref bean="shibboleth.SAML1TransientGenerator" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> p:attributeSourceIds="#{ {'neuEduNUID'} }" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </util:list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you in advance.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#A00000">David Mak</span></b><span style="font-size:10.5pt;color:black"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;color:#A00000">Identity Services Specialist</span></b><span style="color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Information Technology Services</span><span style="color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Northeastern University</span><span style="color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">360 Huntington Ave. Boston MA 02115-5000</span><span style="color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Mail Stop: 322-C21</span><span style="color:#212121"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Office: 617-373-7836 <span style="background:#FFFEFE">Mobile: 617-840-7543</span></span><o:p></o:p></p>
</div>
</body>
</html>