<div dir="ltr">Hi Melvin, I have our Banner9 setup on idp 3.x in our test environment. It's been a while since I set it up so I'm a little rusty and I'm sure my configuration is a little different but I would be glad to help where I can and when I have time. Feel free to email me directly and also try the bannerdba users group too.<div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Feb 14, 2019 at 9:16 AM Pablo Vidaurri <<a href="mailto:psvidaurri@gmail.com">psvidaurri@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><i>I also don’t see my employeeNumber anywhere in the logs </i><br><div><i><br></i></div><div><i>you are attempting to release via the filters config, but have resolved it first from a datasource in your resolver config?</i></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Feb 14, 2019 at 8:22 AM Melvin Lasky <<a href="mailto:melvin.lasky@manhattan.edu" target="_blank">melvin.lasky@manhattan.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Hey everyone,<div><span class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-tab-span" style="white-space:pre-wrap"> </span>I’m new to Shibboleth and we are trying to abandon our Ellucian Ethos Identity and go straight Shibboleth [for many reasons].</div><div><br></div><div>We are using the docker container version of Shibboleth provided by Internet2 so that it’s all set up for InCommon Federation and everything. I have it successfully running on Google Kubernetes Engine, and I have a test SP running also on GKE and am able to log in and test it.</div><div><br></div><div>Now, on to the real stuff. We are a Banner institution. I would like to use Shibboleth’s built in CAS Server, however, I can’t seem to figure it out. Our UDC_IDENTIFIER is stored as employeeNumber in LDAP. I see that in attribute-resolver.xml</div><div><br></div><div>In my cas-protocol.xml I have this:</div><div><br></div><div> <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"<br> c:regex="https://([A-Za-z0-9_-]+\.)*manhattan\.edu(:\d+)?/.*"<br> p:group="manhattan-college"<br> p:authorizedToProxy="false" /></div><div><br></div><div>And I am able to log into let’s say a Banner 9 app. However, upon logging in I am greeted with this message:</div><div><br></div><div>System is configured for external authentication and identity assertion is null<br><br></div><div>So then I set up this RelyingPartyOverrides:</div><div><br></div><div> <bean id="shibboleth.regexRelyingParty" parent="RelyingParty" ><br> <property name="activationCondition" ><br> <bean class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" ><br> <constructor-arg name="pred" ><br> <bean class="com.google.common.base.Predicates" factory-method="or" ><br> <constructor-arg><br> <util:list><br> <bean class="com.google.common.base.Predicates" factory-method="containsPattern"<br> c:_0="<a href="https://ourappservers.*%5C.manhattan%5C.edu" target="_blank">https://ourappservers.*\.manhattan\.edu</a>/.*" /><br> </util:list><br> </constructor-arg><br> </bean><br> </constructor-arg><br> </bean><br> </property><br> <property name="profileConfigurations"><br> <list><br> <ref bean="CAS.LoginConfiguration" /><br> <ref bean="CAS.ProxyConfiguration" /><br> <bean parent="CAS.ValidateConfiguration" p:userAttribute="employeeNumber" /><br> </list><br> </property> <br> </bean></div><div><br></div><div>Now I get:</div><div><br></div><div>HTTP Status 403 - No assertions found.<br><br>type Status report<br><br>message No assertions found.<br><br>description Access to the specified resource has been forbidden.</div><div><br></div><div>Also this is now in the logs:</div><div><br></div><div>shib-idp;idp-process.log;dev;nothing;2019-02-14 14:17:31,834 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception<br>shib-idp;idp-process.log;dev;nothing;java.lang.IllegalStateException: Principal cannot be null<br>shib-idp;idp-process.log;dev;nothing;<span class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-tab-span" style="white-space:pre-wrap"> </span>at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)<br>shib-idp;idp-warn.log;dev;nothing;2019-02-14 14:17:31,834 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception<br>shib-idp;idp-warn.log;dev;nothing;java.lang.IllegalStateException: Principal cannot be null<br>shib-idp;idp-warn.log;dev;nothing;<span class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-tab-span" style="white-space:pre-wrap"> </span>at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)<br></div><div><br></div><div>———————</div><div><br></div><div>I also have this in my attribute-filter.xml</div><div><br></div><div><AttributeFilterPolicy id="releaseForBannerApps" ><br> <PolicyRequirementRule xsi:type="RequesterRegex" regex="https:\/\/ourappservers.*\.manhattan\.edu" /><br> <AttributeRule attributeID="employeeNumber"><br> <PermitValueRule xsi:type="ANY" /><br> </AttributeRule><br></AttributeFilterPolicy></div><div><br></div><div><br></div><div>—————————————————————————————————————————</div><div><br></div><div>Also - our Banner App Servers are looking for the claim UDC_IDENTIFIER…. But I can change that to whatever if I have to. Or whatever I need.</div><div><br></div><div>Any suggestions on how we could get this to work would be awesome? I’m really at a loss.</div><div><br></div><div>I also don’t see my employeeNumber anywhere in the logs </div><div> </div><div>Thank you for any help you can provide!</div><div><br></div><div>Have a great day! </div><div><br></div><div>Mel</div><div><br></div><div><div>
<div><b style="font-size:14px;background-color:rgb(255,255,255);color:rgb(0,102,0);font-family:georgia,serif">Melvin Lasky</b></div><div><div style="color:rgb(0,0,0);font-family:Helvetica;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;font-variant-ligatures:normal;line-height:normal;font-size:14px;background-color:rgb(255,255,255)"><font color="#006600" face="georgia, serif"><span><i>Associate Director of Enterprise Architecture</i></span></font></div><div style="font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;font-variant-ligatures:normal;line-height:normal;color:rgb(34,34,34);font-family:arial,sans-serif;font-size:14px;background-color:rgb(255,255,255)"><font face="georgia, serif"><span style="color:rgb(34,34,34);font-family:georgia,serif;font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><span><span><span style="color:rgb(34,34,34);font-family:georgia,serif;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><span><br class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-interchange-newline"><span><img id="gmail-m_-6043351639035901115gmail-m_8847768468037803597CFBBACBE-44A6-4BA2-8F3E-5A12F9DB88C3" src="cid:168ecca95a63390b2611"></span><div style="font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;font-variant-ligatures:normal;line-height:normal;color:rgb(0,0,0);font-family:Helvetica;font-size:12px"><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:14px;background-color:rgb(255,255,255)"><font face="georgia, serif"><br class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-interchange-newline"><br class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-interchange-newline"><br class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-interchange-newline">Riverdale, NY 10471</font></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:14px;background-color:rgb(255,255,255)"><font face="georgia, serif">Phone: 718-862-7410</font></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:14px;background-color:rgb(255,255,255)"><a href="mailto:melvin.lasky@manhattan.edu" style="font-family:georgia,serif;color:rgb(6,88,181)" target="_blank">melvin.lasky@manhattan.edu</a></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:14px;background-color:rgb(255,255,255)"><font color="#006600" face="georgia, serif"><a href="http://www.manhattan.edu/" style="color:rgb(6,88,181)" target="_blank">www.manhattan.edu</a></font></div></div><div style="font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;font-variant-ligatures:normal;line-height:normal;color:rgb(0,0,0);font-family:Helvetica;font-size:12px"><br></div><br class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-interchange-newline" style="color:rgb(34,34,34);font-family:georgia,serif;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;font-variant-ligatures:normal;line-height:normal"><br class="gmail-m_-6043351639035901115gmail-m_8847768468037803597Apple-interchange-newline" style="color:rgb(34,34,34);font-family:georgia,serif;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;font-variant-ligatures:normal;line-height:normal">
</span></span></span></span></span></font></div><font face="georgia, serif">
</font></div></div><br></div></div>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>