The CalNet Sponsored Guest service allows guests to log into your application using their personal Google/Gmail login. In order to get this access, guests need to be invited by a sponsor, which can be any UC Berkeley employee. Upon the guest’s acceptance of the invitation, the CalNet Sponsored Guest service creates an account using the guest’s Google login.
To allow CalNet Sponsored Guests access to your application:
Open a Service Request in Service Now to Modify your CAS service. Please include the following information:
Service Name: your application name
Service URL: your application CAS url
Please describe the changes you need to make to your CAS service in detail: include your LDAP bind account, and a note that you want to allow Sponsored Guests to access your service.
Make sure your lookup filters, LDAP calls, and code refer to berkeleyEduAffiliations = GUEST-TYPE-SPONSORED and the Guests OU
CalNet will do the following:
Ensure that your CAS service definition is specific to your application (not the default wildcard service definition).
Update your CAS service definition to include CalNet Sponsored Guests.
allow berkeleyEduAffiliations = GUEST-TYPE-SPONSORED
Update your CAS service definition to use the CAS “cirrus” theme (which includes the CalNet Sponsored Guest sign in link ).
Update your LDAP bind account to access the Guests OU if needed.
Important changes regarding Sponsored Guests:
- Sponsored Guests do not have a CalNetID; they do still have a CalNet UID
The berkeleyEduKerberosPrincipalString will contain uidNNNNNNN where the NNNs are the UID value
Sponsored Guest accounts may be sponsored by multiple sponsors; any sponsor may re-activate the guest at any time. Your application or your application sponsors will need to actively manage authorization to your guests.
Example of Available Guest Attributes in LDAP:
dn: uid=NNNNNNN,ou=guests,dc=berkeley,dc=eduobjectClass: berkeleyEduPersonobjectClass: eduPersonobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topobjectClass: ucEduPersoncn: Guest, MyUCBsn: Guestuid: NNNNNNNberkeleyEduKerberosPrincipalString: uidNNNNNNN
mail: <guest email address>
berkeleyEduGuestSponsorUid: nnnnnnn (Note that this is the most recent sponsor to invite the guest)
displayName: MyUCB Guest
Need more help? Email firstname.lastname@example.org for assistance.