<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hey everyone,<div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>I’m new to Shibboleth and we are trying to abandon our Ellucian Ethos Identity and go straight Shibboleth [for many reasons].</div><div class=""><br class=""></div><div class="">We are using the docker container version of Shibboleth provided by Internet2 so that it’s all set up for InCommon Federation and everything. I have it successfully running on Google Kubernetes Engine, and I have a test SP running also on GKE and am able to log in and test it.</div><div class=""><br class=""></div><div class="">Now, on to the real stuff. We are a Banner institution. I would like to use Shibboleth’s built in CAS Server, however, I can’t seem to figure it out. Our UDC_IDENTIFIER is stored as employeeNumber in LDAP. I see that in attribute-resolver.xml</div><div class=""><br class=""></div><div class="">In my cas-protocol.xml I have this:</div><div class=""><br class=""></div><div class=""> <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"<br class=""> c:regex="https://([A-Za-z0-9_-]+\.)*manhattan\.edu(:\d+)?/.*"<br class=""> p:group="manhattan-college"<br class=""> p:authorizedToProxy="false" /></div><div class=""><br class=""></div><div class="">And I am able to log into let’s say a Banner 9 app. However, upon logging in I am greeted with this message:</div><div class=""><br class=""></div><div class="">System is configured for external authentication and identity assertion is null<br class=""><br class=""></div><div class="">So then I set up this RelyingPartyOverrides:</div><div class=""><br class=""></div><div class=""> <bean id="shibboleth.regexRelyingParty" parent="RelyingParty" ><br class=""> <property name="activationCondition" ><br class=""> <bean class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" ><br class=""> <constructor-arg name="pred" ><br class=""> <bean class="com.google.common.base.Predicates" factory-method="or" ><br class=""> <constructor-arg><br class=""> <util:list><br class=""> <bean class="com.google.common.base.Predicates" factory-method="containsPattern"<br class=""> c:_0="<a href="https://ourappservers.*\.manhattan\.edu" class="">https://ourappservers.*\.manhattan\.edu</a>/.*" /><br class=""> </util:list><br class=""> </constructor-arg><br class=""> </bean><br class=""> </constructor-arg><br class=""> </bean><br class=""> </property><br class=""> <property name="profileConfigurations"><br class=""> <list><br class=""> <ref bean="CAS.LoginConfiguration" /><br class=""> <ref bean="CAS.ProxyConfiguration" /><br class=""> <bean parent="CAS.ValidateConfiguration" p:userAttribute="employeeNumber" /><br class=""> </list><br class=""> </property> <br class=""> </bean></div><div class=""><br class=""></div><div class="">Now I get:</div><div class=""><br class=""></div><div class="">HTTP Status 403 - No assertions found.<br class=""><br class="">type Status report<br class=""><br class="">message No assertions found.<br class=""><br class="">description Access to the specified resource has been forbidden.</div><div class=""><br class=""></div><div class="">Also this is now in the logs:</div><div class=""><br class=""></div><div class="">shib-idp;idp-process.log;dev;nothing;2019-02-14 14:17:31,834 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception<br class="">shib-idp;idp-process.log;dev;nothing;java.lang.IllegalStateException: Principal cannot be null<br class="">shib-idp;idp-process.log;dev;nothing;<span class="Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)<br class="">shib-idp;idp-warn.log;dev;nothing;2019-02-14 14:17:31,834 - ERROR [net.shibboleth.idp.cas:-2] - Uncaught runtime exception<br class="">shib-idp;idp-warn.log;dev;nothing;java.lang.IllegalStateException: Principal cannot be null<br class="">shib-idp;idp-warn.log;dev;nothing;<span class="Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction.doExecute(PrepareTicketValidationResponseAction.java:101)<br class=""></div><div class=""><br class=""></div><div class="">———————</div><div class=""><br class=""></div><div class="">I also have this in my attribute-filter.xml</div><div class=""><br class=""></div><div class=""><AttributeFilterPolicy id="releaseForBannerApps" ><br class=""> <PolicyRequirementRule xsi:type="RequesterRegex" regex="https:\/\/ourappservers.*\.manhattan\.edu" /><br class=""> <AttributeRule attributeID="employeeNumber"><br class=""> <PermitValueRule xsi:type="ANY" /><br class=""> </AttributeRule><br class=""></AttributeFilterPolicy></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">—————————————————————————————————————————</div><div class=""><br class=""></div><div class="">Also - our Banner App Servers are looking for the claim UDC_IDENTIFIER…. But I can change that to whatever if I have to. Or whatever I need.</div><div class=""><br class=""></div><div class="">Any suggestions on how we could get this to work would be awesome? I’m really at a loss.</div><div class=""><br class=""></div><div class="">I also don’t see my employeeNumber anywhere in the logs </div><div class=""> </div><div class="">Thank you for any help you can provide!</div><div class=""><br class=""></div><div class="">Have a great day! </div><div class=""><br class=""></div><div class="">Mel</div><div class=""><br class=""></div><div class=""><div class="">
<div class=""><b style="font-size: 14px; background-color: rgb(255, 255, 255); color: rgb(0, 102, 0); font-family: georgia, serif;" class="">Melvin Lasky</b></div><div class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; font-size: 14px; background-color: rgb(255, 255, 255);" class=""><font color="#006600" face="georgia, serif" class=""><span style="caret-color: rgb(0, 102, 0);" class=""><i class="">Associate Director of Enterprise Architecture</i></span></font></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);" class=""><font face="georgia, serif" class=""><span style="color: rgb(34, 34, 34); font-family: georgia, serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><span><span style="color: rgb(34, 34, 34); font-family: georgia, serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><br class="Apple-interchange-newline"><span><img apple-inline="yes" id="CFBBACBE-44A6-4BA2-8F3E-5A12F9DB88C3" src="cid:7B5B252C-AE36-47D6-A49C-64373517FC74" class=""></span><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px;" class=""><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);" class=""><font face="georgia, serif" class=""><br class="Apple-interchange-newline"><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">Riverdale, NY 10471</font></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);" class=""><font face="georgia, serif" class="">Phone: 718-862-7410</font></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);" class=""><a href="mailto:melvin.lasky@manhattan.edu" target="_blank" style="font-family: georgia, serif; color: rgb(6, 88, 181);" class="">melvin.lasky@manhattan.edu</a></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);" class=""><font color="#006600" face="georgia, serif" class=""><a href="http://www.manhattan.edu/" target="_blank" style="color: rgb(6, 88, 181);" class="">www.manhattan.edu</a></font></div></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px;" class=""><br class=""></div><br class="Apple-interchange-newline" style="caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: georgia, serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal;"><br class="Apple-interchange-newline" style="caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: georgia, serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal;">
</span></span></span></span></span></font></div><font face="georgia, serif" class="">
</font></div></div><br class=""></div></body></html>