[JIRA] Created: (SIDP-506) IdP 2.3.3 duplicates attributes and breaks login

Tue Aug 2 04:51:26 BST 2011

IdP 2.3.3 duplicates attributes and breaks login
------------------------------------------------

                 Key: SIDP-506
                 URL: https://issues.shibboleth.net/jira/browse/SIDP-506
             Project: Shibboleth IdP 2 - Java
          Issue Type: Bug
          Components: Attribute Resolution
    Affects Versions: 2.3.3
         Environment: Tomcat6 on RHEL6, OpenJDK 1.6.0
            Reporter: vladimir.mencl at idp.protectnetwork.org
            Assignee: Chad La Joie
            Priority: Blocker

After updating (luckily only a DEV box) from 2.3.2 to 2.3.3, we could test successfully against one SP, but ran into issues with another SP that was requesting "all" attributes:

* On the uApprove screen, all attributes had their value listed twice
* After confirming in uApprove (or bypassing uApprove on subsequent tries), we got the following error:

https://idp-dev.cqu.edu.au/idp/profile/SAML2/Redirect/SSO

{noformat}
ERROR

An error occurred while processing your request. Please contact your helpdesk or user ID office for assistance.

This service requires cookies. Please ensure that they are enabled and try your going back to your desired resource and trying to login again.

Use of your browser's back button may cause specific errors that can be resolved by going back to your desired resource and trying to login again.

If you think you were sent here in error, please contact technical support 
{noformat}

and the following stack-trace in {{idp-process.log}}:
{noformat}
13:43:20.363 - INFO [Shibboleth-Access:74] - 20110802T034320Z|132.181.65.178|idp-dev.cqu.edu.au:443|/profile/SAML2/Redirect/SSO|
13:43:20.641 - ERROR [edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89] - Error occurred while processing request
java.lang.IllegalArgumentException: {urn:oasis:names:tc:SAML:2.0:assertion}NameID is already the child of another XMLObject and may not be inserted in to this list
	at org.opensaml.xml.util.XMLObjectChildrenList.setParent(XMLObjectChildrenList.java:201) ~[xmltooling-1.3.2.jar:na]
	at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:146) ~[xmltooling-1.3.2.jar:na]
	at org.opensaml.xml.util.IndexedXMLObjectChildrenList.add(IndexedXMLObjectChildrenList.java:71) ~[xmltooling-1.3.2.jar:na]
	at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:1) ~[xmltooling-1.3.2.jar:na]
	at java.util.AbstractList.add(AbstractList.java:108) ~[na:1.6.0_20]
	at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:61) ~[shibboleth-common-1.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:35) ~[shibboleth-common-1.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.encodeAttributes(ShibbolethSAML2AttributeAuthority.java:211) ~[shibboleth-common-1.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.buildAttributeStatement(ShibbolethSAML2AttributeAuthority.java:118) ~[shibboleth-common-1.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildAttributeStatement(AbstractSAML2ProfileHandler.java:509) ~[shibboleth-identityprovider-2.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:276) ~[shibboleth-identityprovider-2.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) ~[shibboleth-identityprovider-2.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) ~[shibboleth-identityprovider-2.3.3.jar:na]
	at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) ~[shibboleth-common-1.3.3.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
	at ch.SWITCH.aai.uApprove.idpplugin.Dispatcher.dispatchToIdP(Dispatcher.java:64) [idp-plugin-2.2.1.jar:na]
	at ch.SWITCH.aai.uApprove.idpplugin.Plugin.checkAccess(Plugin.java:202) [idp-plugin-2.2.1.jar:na]
	at ch.SWITCH.aai.uApprove.idpplugin.Plugin.doFilter(Plugin.java:119) [idp-plugin-2.2.1.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.3.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.3.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.3.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
	at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote-6.0.24.jar:na]
	at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote-6.0.24.jar:na]
	at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote-6.0.24.jar:na]
	at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote-6.0.24.jar:na]
	at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote-6.0.24.jar:na]
	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote-6.0.24.jar:na]
	at java.lang.Thread.run(Thread.java:636) [na:1.6.0_20]
{noformat}

We have worked-around this by down-grading to 2.3.2 - but this appears to be a critical blocker to me.

Cheers,
Vlad

-- 
Vladimir Mencl, Ph.D.
E-Research Services and Systems Consultant
BlueFern Computing Services
University of Canterbury
Private Bag 4800
Christchurch 8140
New Zealand

http://www.bluefern.canterbury.ac.nz
mailto:vladimir.mencl at canterbury.ac.nz
Phone: +64 3 364 3012
Mobile: +64 21 997 352
Fax: +64 3 364 3002

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira