<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Melvin,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would also suggest starting from the beginning and confirming your LDAP authentication and attribute configurations are working as expected.<o:p></o:p></p>
<p class="MsoNormal">To confirm that the logging updates worked – do you see other LDAP DEBUG messages in the log?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I know you said you have an SP setup – does that SP receive the expected attributes?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">You should be able to get enough logging out of the IdP to indicate exactly what is happening.<o:p></o:p></p>
<p class="MsoNormal">Specifically, check out the ‘Logging Categories’ section which has an example for logging attribute data:<o:p></o:p></p>
<p class="MsoNormal"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration#LoggingConfiguration-VariablesandProperties">https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration#LoggingConfiguration-VariablesandProperties</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="background:white;border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="border:solid #C1C7D0 1.0pt;padding:5.25pt 7.5pt 5.25pt 7.5pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">net.shibboleth.idp.attribute<o:p></o:p></span></p>
</td>
<td valign="top" style="border:solid #C1C7D0 1.0pt;border-left:none;padding:5.25pt 7.5pt 5.25pt 7.5pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">Messages related to attribute resolution and filtering<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Tom<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Marvin Addison<br>
<b>Sent:</b> Thursday, February 14, 2019 2:20 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Help setting up Shib's 3.4.3 Built-in CAS Server for Banner Apps<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Feb 14, 2019 at 2:10 PM Melvin Lasky <<a href="mailto:melvin.lasky@manhattan.edu">melvin.lasky@manhattan.edu</a>> wrote:<o:p></o:p></p>
</div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><AttributeFilterPolicy id="releaseForBannerApps" ><br>
<PolicyRequirementRule xsi:type="Requester" value="<a href="https://specific_banner_app_server.manhattan.edu" target="_blank">https://specific_banner_app_server.manhattan.edu</a>" /><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If you register services via the CAS service registry, then the relying party ID will be _exactly_ the value sent to the IdP in the "service" CAS protocol parameter. I suspect that's the problem here given that the URL above has no path
or query parts. Look at the traffic between your Banner apps and Shib using your browser's developer console to capture the exact service URL that's getting sent to Shib, then update your attribute filter rule accordingly.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hope that helps,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Marvin<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>