<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0in;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:Helvetica;
color:#3F7F5F;}
p.p2, li.p2, div.p2
{mso-style-name:p2;
margin:0in;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:Helvetica;}
p.p3, li.p3, div.p3
{mso-style-name:p3;
margin:0in;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:Helvetica;}
p.p4, li.p4, div.p4
{mso-style-name:p4;
margin:0in;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:Helvetica;
color:#2A00FF;}
span.s1
{mso-style-name:s1;
color:#2A00FF;}
span.s2
{mso-style-name:s2;
color:black;}
span.s3
{mso-style-name:s3;
text-decoration:underline;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi Michael,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We were using RemoteUser authentication using MOD_AUTH_CAS client. Instead I am trying to use the CAS plugin.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here are my idp.properties changes:<o:p></o:p></p>
<p class="p1">#idp.authn.flows=Password|RemoteUser<o:p></o:p></p>
<p class="p2">idp.authn.flows = <span class="s1">External</span><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p1"># CAS Client properties (usage loosely matches that of the Java CAS Client)<o:p></o:p></p>
<p class="p1">## CAS Server Properties<o:p></o:p></p>
<p class="p2">shibcas.casServerUrlPrefix = <span class="s1">https://cas.hbsstg.org/cas</span><o:p></o:p></p>
<p class="p4"><span class="s2">shibcas.casServerLoginUrl = </span>${shibcas.casServerUrlPrefix}/login<o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p1">## <span class="s3">Shibboleth</span> Server Properties<o:p></o:p></p>
<p class="p4"><span class="s2">shibcas.serverName = </span>https://sso.hbsstg.org<o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p1"># By default you always get the AuthenticatedNameTranslator, add additional code to cover your custom needs.<o:p></o:p></p>
<p class="p1"># Takes a comma separated list of fully qualified class names<o:p></o:p></p>
<p class="p1"># shibcas.casToShibTranslators = com.your.institution.MyCustomNamedTranslatorClass<o:p></o:p></p>
<p class="p1"># shibcas.parameterBuilders = com.your.institution.MyParameterBuilderClass<o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p1"># Specify CAS <span class="s3">validator</span> to use - either 'cas10', 'cas20' or 'cas30' (default)<o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"> </span>shibcas.ticketValidatorName =
<span class="s1">cas20</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is the general-authn.xml file:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F5F"><!-- <bean id="authn/External" parent="shibboleth.AuthenticationFlow"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F5F"> p:nonBrowserSupported="false" /> --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black"> <<b>bean</b>
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">id</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"authn/External"</span><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">parent</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"shibboleth.AuthenticationFlow"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">p</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">:</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">passiveAuthenticationSupported</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"true"</span><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">p</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">:</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">forcedAuthenticationSupported</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"true"</span><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">p</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">:</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">nonBrowserSupported</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"false"</span><span style="font-size:9.0pt;font-family:Helvetica;color:black">></span><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> <<b>property</b>
<b><span style="color:#7F0055">name</span></b>=<span style="color:#2A00FF">"supportedPrincipals"</span>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> <<b>list</b>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black"> <<b>bean</b>
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">parent</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">c</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">:</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">classRef</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"https://refeds.org/profile/mfa"</span><span style="font-size:9.0pt;font-family:Helvetica;color:black">
/></span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black"> <<b>bean</b>
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">parent</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">c</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">:</span><b><span style="font-size:9.0pt;font-family:Helvetica;color:#7F0055">classRef</span></b><span style="font-size:9.0pt;font-family:Helvetica;color:black">=</span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF">"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"</span><span style="font-size:9.0pt;font-family:Helvetica;color:black">
/></span><span style="font-size:9.0pt;font-family:Helvetica;color:#2A00FF"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> </<b>list</b>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> </<b>property</b>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> </<b>bean</b>><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is the edit-webapp/WEB-INF/web.xml change:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F5FBF"><!-- <u>
Servlet</u> for receiving a callback from an external CAS Server and continues the IdP login flow --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal"><</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F">servlet</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal">></span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> <span style="color:teal">
<</span><span style="color:#3F7F7F">servlet-name</span><span style="color:teal">></span>ShibCas
<u>Auth</u> <u>Servlet</u><span style="color:teal"></</span><span style="color:#3F7F7F">servlet-name</span><span style="color:teal">></span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> <span style="color:teal">
<</span><span style="color:#3F7F7F">servlet-class</span><span style="color:teal">></span>net.unicon.idp.externalauth.ShibcasAuthServlet<span style="color:teal"></</span><span style="color:#3F7F7F">servlet-class</span><span style="color:teal">></span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal"><</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F">load-on-startup</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal">></span><span style="font-size:9.0pt;font-family:Helvetica;color:black">2</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal"></</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F">load-on-startup</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal">></span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal"></</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F">servlet</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal">></span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal"><</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F">servlet-mapping</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal">></span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> <span style="color:teal">
<</span><span style="color:#3F7F7F">servlet-name</span><span style="color:teal">></span>ShibCas
<u>Auth</u> <u>Servlet</u><span style="color:teal"></</span><span style="color:#3F7F7F">servlet-name</span><span style="color:teal">></span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"> <span style="color:teal">
<</span><span style="color:#3F7F7F">url-pattern</span><span style="color:teal">></span>/<u>Authn</u>/External/*<span style="color:teal"></</span><span style="color:#3F7F7F">url-pattern</span><span style="color:teal">></span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">
</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal"></</span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F">servlet-mapping</span><span style="font-size:9.0pt;font-family:Helvetica;color:teal">></span><span style="font-size:9.0pt;font-family:Helvetica;color:#3F7F7F"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I added no-conversation-state.jsp file to edit-webapp folder. I also added cas-client-core-3.6.0.jar and shib-cas-authenticator-3.3.0.jar files to edit-webapp/WEB-INF/lib folder.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I confirmed that the changes are reflected inside the docker container.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Sunil<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Michael A Grady <mgrady@unicon.net><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Monday, June 22, 2020 at 10:19 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Shibboleth IdP v3.X plugin for authentication via an external CAS Server<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jun 21, 2020, at 6:00 AM, Mathew, Sunil <<a href="mailto:smathew@hbs.edu">smathew@hbs.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thanks, I am not using MFA (only CAS). I should have mentioned that I am using Shibboleth docker image<o:p></o:p></p>
</div>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As Peter indicated, how you are deploying the IdP does not matter. And whether you are using MFA does not matter. You sitll need to update the IdP to tell it what types of authentication the authn/External flow is intended to support. So
just list the Password context if you aren't also using MFA,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Have you used the Shib-CAS-Authn3 plugin in the past, back when it required you to add a new flow, the authn/Shibcas one?<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And what flow(s) do you have listed in your idp.properties as being active?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica;color:black">--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica;color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>