<div dir="ltr"><div>Fazla,</div><div><br></div><div>That makes a lot more sense. Thank you for taking the time to read it all. Your configuration makes sense to me too.<br></div><div><br></div><div>All you need to do is start a SAML transaction with your IdP by going to a SAML service. If you don't have a specific SP already trusted and used, there is a beta free testing service that you can use at <a href="https://samltest.id">https://samltest.id</a>.</div><div><br></div><div>You can upload your IdP's metadata by going to the upload page and entering <a href="https://your.host/idp/shibboleth">https://your.host/idp/shibboleth</a>, or if the host doesn't have an address, by downloading the file /opt/shibboleth-idp/metadata/idp-metadata.xml to your computer and then uploading it to SAMLtest as a starting point.</div><div><br></div><div>Then, make your IdP trust SAMLtest by modifying your configuration like in the "Download Metadata" section.</div><div><br></div><div>Finally, just click the IdP test button and enter the entityID of your Shibboleth installation, and you will be redirected with a full SAML request and you will see whether ShibCas works.</div><div><br></div><div>Take care,</div><div>Nate.<br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 6, 2018 at 4:57 AM, fazla <span dir="ltr"><<a href="mailto:fazlarabby043264@gmail.com" target="_blank">fazlarabby043264@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Nate. <br>
<br>
Thanks a lot for your detailed response. <br>
<br>
I am using ShibCas that delegates the authentication to an external Central<br>
Authentication Server. <br>
<br>
<br>
For that at first I have installed shibboleth IdP 3.3.3.1 with Getty and<br>
then I have downloaded the shibboleth IdP V 3.X plugin for authentication<br>
via an external CAS server from the gihub. Then from there <br>
<br>
<br>
I have copied the Spring Webflow files, jsp, and included jar files into<br>
the IDP_HOME.<br>
1st Copied the gradle-wrapper.jar and pasted it to<br>
Shibboleth\IdP\edit-webapp\<wbr>WEB-INF\lib. Then copied the jsp and put it in<br>
Shibboleth\IdP\edit-webapp\<wbr>WEB-INF\jsp. also copied the<br>
shibcas-authn-flow.xml and shibcas-authn-beans.xml to<br>
Shibboleth\IdP\flows\authn\<wbr>Shibcas<br>
couldn't update the IdP's web.xml. as after adding the ShibCas Auth<br>
Servlet I am getting a 503<br>
<br>
<servlet><br>
<servlet-name>ShibCas Auth Servlet</servlet-name><br>
<br>
<servlet-class>net.unicon.idp.<wbr>externalauth.<wbr>ShibcasAuthServlet</servlet-<wbr>class><br>
<load-on-startup>2</load-on-<wbr>startup><br>
</servlet><br>
<servlet-mapping><br>
<servlet-name>ShibCas Auth Servlet</servlet-name><br>
<url-pattern>/Authn/ExtCas/*</<wbr>url-pattern><br>
</servlet-mapping><br>
<br>
As it is optional so I have escape this step.<br>
<br>
Updated the IdP's idp.properties file.<br>
<br>
# Regular expression matching login flows to enable, e.g. IPAddress|Password<br>
#idp.authn.flows = Password<br>
idp.authn.flows = Shibcas<br>
<br>
# CAS Client properties (usage loosely matches that of the Java CAS Client)<br>
## CAS Server Properties<br>
shibcas.casServerUrlPrefix = <a href="https://cas.mycasserver.edu/cas" rel="noreferrer" target="_blank">https://cas.mycasserver.edu/<wbr>cas</a><br>
shibcas.casServerLoginUrl = ${shibcas.casServerUrlPrefix}/<wbr>login<br>
<br>
## Shibboleth Server Properties<br>
shibcas.serverName = <a href="https://idp.myshibbolethserver.edu" rel="noreferrer" target="_blank">https://idp.<wbr>myshibbolethserver.edu</a><br>
<br>
# By default you always get the AuthenticatedNameTranslator, add additional<br>
code to cover your custom needs.<br>
# Takes a comma separated list of fully qualified class names<br>
# shibcas.casToShibTranslators =<br>
com.your.institution.<wbr>MyCustomNamedTranslatorClass<br>
# shibcas.parameterBuilders = com.your.institution.<wbr>MyParameterBuilderClass<br>
<br>
# Specify CAS validator to use - either 'cas10', 'cas20' or 'cas30'<br>
(default)<br>
# shibcas.ticketValidatorName = cas30<br>
<br>
<br>
# Specify if the Relying Party/Service Provider entityId should be appended<br>
as a separate entityId query string parameter<br>
# or embedded in the "service" querystring parameter - `append` (default) or<br>
`embed`<br>
# shibcas.entityIdLocation = append<br>
<br>
<br>
Updated the IdP's general-authn.xml file.<br>
<br>
<util:list id="shibboleth.<wbr>AvailableAuthenticationFlows"><br>
<br>
<bean id="authn/Shibcas" parent="shibboleth.<wbr>AuthenticationFlow"<br>
p:<wbr>passiveAuthenticationSupported<wbr>="true"<br>
p:<wbr>forcedAuthenticationSupported=<wbr>"true"<br>
p:nonBrowserSupported="false" /><br>
<br>
<br>
Rebuilded the war file.<br>
<br>
Now can you please let me know what step should I follow and how can I check<br>
whether it will delegate the authentication to cas? what should be the<br>
correct url to check too.<br>
<span class=""><br>
<br>
<br>
<br>
Fazla,<br>
<br>
I think you're still conflating the two ways that Shibboleth can interact<br>
with CAS.<br>
<br>
It can either act as a CAS server(which is the endpoint you're accessing,<br>
and which does not need ShibCas) for CAS client applications using the CAS<br>
protocol<br>
<br>
or<br>
<br>
it can be a CAS client(ShibCas) of an actual CAS server. ShibCas then uses<br>
the authentication provided by that CAS protocol transaction to perform a<br>
secondary assertion of user information to another service, typically using<br>
SAML as a protocol.<br>
<br>
I think you want Shibboleth to be a CAS client, which means the CAS server<br>
functionality built into Shibboleth is not relevant. The flow through the<br>
system would typically be:<br>
<br>
SAML Service Provider -> Shibboleth SAML login point -> CAS Server -><br>
Shibboleth ShibCas plugin -> Shibboleth SAML assertion generation -> SAML<br>
service provider<br>
<br>
I think you should step back and understand how you want users to flow<br>
through the system you're building. There needs to be a clear vector that<br>
is followed.<br>
<br>
I'm not quite sure what else to write, I'm afraid.<br>
<br>
I hope this helps,<br>
Nate.<br>
<br>
</span><span class="">On Thu, Sep 6, 2018 at 1:11 AM, fazla <fazlarabby043264@> wrote:<br>
<br>
> We are trying to delegate the shibboleth IdP authentication to CAS. The<br>
> ShibCas plugin is already added and then the service was also added in the<br>
> cas-protocol.xml. I have attached relying-party.xml<br>
</span>> <<a href="http://shibboleth.1660669.n2.nabble.com/file/t398743/relying-party.xml>" rel="noreferrer" target="_blank">http://shibboleth.1660669.<wbr>n2.nabble.com/file/t398743/<wbr>relying-party.xml></a>;<br>
> ,<br>
> cas-protocol.xml<br>
> <<a href="http://shibboleth.1660669.n2.nabble.com/file/t398743/cas-protocol.xml>" rel="noreferrer" target="_blank">http://shibboleth.1660669.<wbr>n2.nabble.com/file/t398743/<wbr>cas-protocol.xml></a>;<br>
> and general-authn.xml<br>
> <<a href="http://shibboleth.1660669.n2.nabble.com/file/t398743/general-authn.xml>" rel="noreferrer" target="_blank">http://shibboleth.1660669.<wbr>n2.nabble.com/file/t398743/<wbr>general-authn.xml></a>;<br>
<div class="HOEnZb"><div class="h5">> .<br>
><br>
> Now if we try<br>
> <a href="https://localhost:8443/idp/profile/cas/login?service=" rel="noreferrer" target="_blank">https://localhost:8443/idp/<wbr>profile/cas/login?service=</a><br>
> <a href="https://myservice.example.edu" rel="noreferrer" target="_blank">https://myservice.example.edu</a><br>
> instead of redirecting us to cas we are getting this error on the browser.<br>
><br>
> Web Login Service - Unsupported Request<br>
> The application you have accessed is not registered for use with this<br>
> service.<br>
><br>
><br>
> This is the logs.<br>
><br>
><br>
><br>
><br>
><br>
><br>
> --<br>
> Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-" rel="noreferrer" target="_blank">http://shibboleth.1660669.n2.<wbr>nabble.com/Shibboleth-Users-</a><br>
> f1660767.html<br>
> --<br>
> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/</a><br>
> confluence/x/coFAAg<br>
> To unsubscribe from this list send an email to<br>
> users-unsubscribe@<br>
><br>
<br>
-- <br>
For Consortium Member technical support, see<br>
<a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@<br>
<br>
<br>
<br>
<br>
<br>
--<br>
Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html" rel="noreferrer" target="_blank">http://shibboleth.1660669.n2.<wbr>nabble.com/Shibboleth-Users-<wbr>f1660767.html</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div>