title: CAS and Shibboleth Integration releasing Principal Name (Username) as an attribute in SAML
body: <p>I feel like I've searched high and low for what should be a simple configuration: and come up empty.</p>
  
  <p>I'm completely new to Shibboleth, although I've worked with CAS a little bit, nothing too intense.  I have it set up (following the guide at: <a href="https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration" rel="nofollow">https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration</a>) so that Shibboleth redirects to CAS for authentication.  This works fine, and once the user is authenticated, they get redirected through Shibboleth, and the SAML response gets sent out.  I'm testing using <a href="https://sp.testshib.org" rel="nofollow">https://sp.testshib.org</a> and it's properly receiving the response and displaying the page.</p>
  
  <p>What I can't seem to figure out is how to release just a simple attribute with the username used to log into CAS.  I know Shibboleth sees it (from the idp-process.log), but I can't figure out what to put in the attribute-resolver.xml and attribute-filter.xml to release this.</p>
  
  <p>The current SAML response looks like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_da56752846e00c2693ece2c486d7c870" IssueInstant="2012-11-16T14:08:07.570Z" Version="2.0"&gt;
     &lt;saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"&gt;https://&lt;idpurl&gt;/idp/shibboleth&lt;/saml2:Issuer&gt;
     &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
        &lt;ds:SignedInfo&gt;
           &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
           &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
           &lt;ds:Reference URI="#_da56752846e00c2693ece2c486d7c870"&gt;
              &lt;ds:Transforms&gt;
                 &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                 &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
              &lt;ds:DigestValue&gt;7OHKEiEQ0ZcPDcnt4B8PIGoLEfw=&lt;/ds:DigestValue&gt;
           &lt;/ds:Reference&gt;
        &lt;/ds:SignedInfo&gt;
        &lt;ds:SignatureValue&gt;S3FZI+KpNf8wUYWMA96ccAj0Y5ebojB1xKHlixHWNEr4voqHOGSpBzxdui0IVtUwLEzj4RrDFdYarJaZj6ltzFV4hfNx5bN88zYQG6w9BBP9UybG+81Wrhii2O31AmRz2Y6XIqa72CeN2R4DKo70awn6FXIPLAcEKs+7dAG2lQ87VS3Wv126DghE/eGcMLW6+z9a3MxXtUFSmWYosaIbNREJn4mGO/uGzD27eeo6SNmvBx/BgVh7T2cOIbtD8b9OOZT8Urt0kZ2nsoCZHgp1T0V6ZgnE2TDvPTInrxzC5c4S+YOYZlB0ijMI6pk+PpJGshe7MVUcEO34Nn0I3i0OUw==&lt;/ds:SignatureValue&gt;
        &lt;ds:KeyInfo&gt;
           &lt;ds:X509Data&gt;
              &lt;ds:X509Certificate&gt;&lt;!--Valid Certificate--&gt;&lt;/ds:X509Certificate&gt;
           &lt;/ds:X509Data&gt;
        &lt;/ds:KeyInfo&gt;
     &lt;/ds:Signature&gt;
     &lt;saml2:Subject&gt;
        &lt;saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://&lt;idpurl&gt;/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp"&gt;_4b1a2780b2ce3db36ea7e7f6192b7108&lt;/saml2:NameID&gt;
        &lt;saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
           &lt;saml2:SubjectConfirmationData Address="&lt;valid ip address&gt;" InResponseTo="_aa4e23dd783eddb1be18ad224c26e7cf" NotOnOrAfter="2012-11-16T14:13:07.570Z" Recipient="https://sp.testshib.org/Shibboleth.sso/SAML2/POST"/&gt;
        &lt;/saml2:SubjectConfirmation&gt;
     &lt;/saml2:Subject&gt;
     &lt;saml2:Conditions NotBefore="2012-11-16T14:08:07.570Z" NotOnOrAfter="2012-11-16T14:13:07.570Z"&gt;
        &lt;saml2:AudienceRestriction&gt;
           &lt;saml2:Audience&gt;https://sp.testshib.org/shibboleth-sp&lt;/saml2:Audience&gt;
        &lt;/saml2:AudienceRestriction&gt;
     &lt;/saml2:Conditions&gt;
     &lt;saml2:AuthnStatement AuthnInstant="2012-11-16T14:08:07.554Z" SessionIndex="00568a153d3cccf9c17abf2c77a043ed8b74a74fe5e2c61000590269aa87f99a"&gt;
        &lt;saml2:SubjectLocality Address="&lt;valid ip address&gt;"/&gt;
        &lt;saml2:AuthnContext&gt;
           &lt;saml2:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml2:AuthnContextClassRef&gt;
        &lt;/saml2:AuthnContext&gt;
     &lt;/saml2:AuthnStatement&gt;
  &lt;/saml2:Assertion&gt; 
  </code></pre>
  
  <p>I just need an example of how to get this set up.  I've read all the documentation on wiki.shibboleth.net and still can't seem to get it.</p>
  
  <p>Thank you so much in advance for your help, I know it's just a configuration thing, but it's making my brain feel dumb, and I haven't even tried integrating with something more intense than TestShib!</p>
  
  <p>EDIT:
  I found this set up guide which partially helps, I was able to pass out the name as an attribute by searching against the active directory, but this isn't a proper long term solution, since CAS can check more than one user repository, and it's not necessarily the same one that this will check to get it.  I just want to release ${requestContext.principalName} as an attribute.</p>
  
  <p>Any better ideas?  Maybe a static connector, but i'm not sure how to get it to resolve the ${requestContext.principalName}?</p>