<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Thank you, Michael. The logs indicate that our relaying party configuration, which was essentially that example, modified as below, seems to be matched to the configuration, but the results just don’t match. To answer Scott’s comment, if
I comment out/remove the SAML1NameIdentifierGenerators in the saml-nameid.xml config, I get the following exception:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2018-04-12 15:12:05,035 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:93] - Filtered attribute neuEduNUID has no value<o:p></o:p></p>
<p class="MsoNormal">2018-04-12 15:12:05,036 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception<o:p></o:p></p>
<p class="MsoNormal">java.lang.IllegalStateException: Principal cannot be null<o:p></o:p></p>
<p class="MsoNormal"> at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here’s the relaying party config:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <!-- The following are CAS services that need to release the NUID instead of the default UID for the username returned to services --><o:p></o:p></p>
<p class="MsoNormal"> <bean id="shibboleth.regexRelyingParty" parent="RelyingParty" ><o:p></o:p></p>
<p class="MsoNormal"> <property name="activationCondition" ><o:p></o:p></p>
<p class="MsoNormal"> <bean class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" ><o:p></o:p></p>
<p class="MsoNormal"> <constructor-arg name="pred" ><o:p></o:p></p>
<p class="MsoNormal"> <bean class="com.google.common.base.Predicates" factory-method="or" ><o:p></o:p></p>
<p class="MsoNormal"> <constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> <util:list><o:p></o:p></p>
<p class="MsoNormal"> <bean class="com.google.common.base.Predicates" factory-method="containsPattern" c:_0="https://bnrxe.*\.neu\.edu\/.*" /><o:p></o:p></p>
<p class="MsoNormal"> <bean class="com.google.common.base.Predicates" factory-method="containsPattern" c:_0="https://neuidmssodev\.neu\.edu\/.*" /><o:p></o:p></p>
<p class="MsoNormal"> </util:list><o:p></o:p></p>
<p class="MsoNormal"> </constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"> </constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> <property name="profileConfigurations"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="CAS.LoginConfiguration" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="CAS.ProxyConfiguration" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="CAS.ValidateConfiguration" p:userAttribute="neuEduNUID" /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Michael A Grady <mgrady@unicon.net><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Thursday, April 12, 2018 at 3:45 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: IDP 3.3.2 CAS protocol and alternate CAS username difficulty<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><a name="_MailOriginalBody"><o:p> </o:p></a></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">On Apr 12, 2018, at 2:36 PM, Mak, David <</span><a href="mailto:d.mak@northeastern.edu"><span style="mso-bookmark:_MailOriginalBody">d.mak@northeastern.edu</span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody">>
wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">’ve hit a block and would like to see if others might be able to point me in the right direction. On a IDP 3.3.2 setup with a CAS configuration setup to release a different attribute as the name-identifier,
I see log entries that show it going through the process but the payload itself doesn’t have the said attribute value as the nameid, but instead, has the login id.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
</div>
</blockquote>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">See the section entitled: <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"> Alternate cas:user in the validation response (Optional) <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">in the following Shib wiki page:
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"> </span><a href="https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration"><span style="mso-bookmark:_MailOriginalBody">https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration</span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:10.5pt;font-family:Helvetica;color:black">--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<o:p></o:p></span></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:10.5pt;font-family:Helvetica;color:black"><o:p> </o:p></span></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>