<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Sorry for the confusion. That condition, with the “Filtered attribute neuEduNUID has no value” in the log only occurs if I comment out the saml-nameid.xml section I detailed. I only added it in there because it seemed as if having the attribute
defined in the attribute resolver and filter configs wasn’t sufficient (see below for config excerpts.) With, or without that saml nameid configuration, other SAML2 or CAS end points that depend on that attribute (neuEduNUID) do get it with valid values. In
my first message, where I included the SOAP payload, that attribute is released as an attribute, but just not as the name identifier. There may be some other odd interaction / configuration issue on our end that might explain why I have to add that attribute
to the saml-nameid configuration, but it does get us further.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Resolver config:<o:p></o:p></p>
<p class="MsoNormal"> <resolver:AttributeDefinition id="neuEduNUID" xsi:type="ad:Simple" sourceAttributeID="neuEduNUID"><o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="myLDAP"/><o:p></o:p></p>
<p class="MsoNormal"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:neuEduNUID"/><o:p></o:p></p>
<p class="MsoNormal"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:neuEduNUID-OID" friendlyName="neuEduNUID"/><o:p></o:p></p>
<p class="MsoNormal"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Filter config:<o:p></o:p></p>
<p class="MsoNormal"><AttributeFilterPolicy id="BANNER" ><o:p></o:p></p>
<p class="MsoNormal"> <PolicyRequirementRule xsi:type="OR"><o:p></o:p></p>
<p class="MsoNormal"> <Rule xsi:type="RequesterRegex" regex="https://bnrxe.*\.neu\.edu(:\d+)?/.*"/><o:p></o:p></p>
<p class="MsoNormal"> <Rule xsi:type="RequesterRegex" regex="https://nubanner\.(northeastern|neu)\.edu(:\d+)?/.*"/><o:p></o:p></p>
<p class="MsoNormal"> </PolicyRequirementRule><o:p></o:p></p>
<p class="MsoNormal"> <AttributeRule attributeID="UDC_IDENTIFIER"><o:p></o:p></p>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><o:p></o:p></p>
<p class="MsoNormal"> </AttributeRule><o:p></o:p></p>
<p class="MsoNormal"> <AttributeRule attributeID="neuEduNUID"><o:p></o:p></p>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><o:p></o:p></p>
<p class="MsoNormal"> </AttributeRule><o:p></o:p></p>
<p class="MsoNormal"></AttributeFilterPolicy><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Michael A Grady <mgrady@unicon.net><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Thursday, April 12, 2018 at 4:18 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: IDP 3.3.2 CAS protocol and alternate CAS username difficulty<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><a name="_MailOriginalBody"> <o:p></o:p></a></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">On Apr 12, 2018, at 2:53 PM, Mak, David <</span><a href="mailto:d.mak@northeastern.edu"><span style="mso-bookmark:_MailOriginalBody">d.mak@northeastern.edu</span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody">>
wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">Thank you, Michael. The logs indicate that our relaying party configuration, which was essentially that example, modified as below, seems to be matched to the configuration, but the results just
don’t match. To answer Scott’s comment, if I comment out/remove the SAML1NameIdentifierGenerators in the saml-nameid.xml config, I get the following exception:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">2018-04-12 15:12:05,035 - DEBUG [net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction:93] - Filtered attribute neuEduNUID has no value<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">2018-04-12 15:12:05,036 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">java.lang.IllegalStateException: Principal cannot be null<o:p></o:p></span></p>
</div>
</div>
</blockquote>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody">As Scott said, I don't think the saml-nameid.xml config has anything to do with CAS. (If it does, that is a new knowledge for me also.) The above says "Filtered attribute neuEduNUID has no value".
Do you have an attribute with an ID of 'neuEduNUID' defined in your resolver, and does the resolver logging show that it successfully got populated with a value?<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:10.5pt;font-family:Helvetica;color:black">--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<o:p></o:p></span></span></p>
</div>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:10.5pt;font-family:Helvetica;color:black"><o:p> </o:p></span></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><br>
<br>
</span><o:p></o:p></p>
</div>
</body>
</html>