Passing attributes to Shibboleth IDP using shib-cas-authn3

[Ted Fisher]

 

Hi.  I can’t believe this issue hasn’t been addressed before, but I can’t find anything in archives, so I’ll ask the question. 

We have CAS 4.15 which has been acting as auth handler for our Shibboleth IDP 2.4.0 using Remote_User (essentially CAS client configed as a simple handler).  We’re upgrading the IDP(s) to 3.3.1 and I’ve put in shib-cas-authn3 to get the better integration (primarily for CAS to see the EntityID from the IDP).  In logs I can see the shib-cas-auth3 is getting attributes from CAS.  So, I should be able to use what CAS sends instead of having to use a separate LDAP data connector to get them again. 

But, I can’t find any guide or example as to how I can access the attributes sent to the external auth.  Do I need to set up a data connector to process what shib-cas-authn has?  Or can I somehow just set up resolvers to access the attributes that are there?  And if so are there examples of what such a data conector or attribute resolver should look like?

Thanks.

Ted Fisher

Bowling Green State University

 

[Tom O'Neill]

Hi Ted,

 

This is something that I’ve come across several times in the past and from what I recall in my previous research, the ShibCas plugin doesn’t support the processing of CAS attributes.

I’ve ended up configuring the attribute resolver in Shibboleth to perform additional LDAP queries after the CAS authentication completes.

 

You may be able to consolidate your SSO services, providing CAS and SAML 2.0 protocol support through a single solution, further simplifying and streamlining your SSO architecture.

 

Thanks,

 

Tom

 

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CY4PR05MB2933955B0F62A1BB8021A1CBC0B20%40CY4PR05MB2933.namprd05.prod.outlook.com.