[JIRA] Commented: (SC-162) Attribute value added multiple times to retained value set if multiple policies permit the same values
Chad La Joie (JIRA)
noreply at shibboleth.net
Tue Aug 2 16:49:25 BST 2011
[ https://issues.shibboleth.net/jira/browse/SC-162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13451#comment-13451 ]
Chad La Joie commented on SC-162:
---------------------------------
This issue may result in duplicate values being released to an SP. This is generally fine, dedupe'ing has never been guaranteed by the IdP nor the SAML specification. So any application that relied on that was making a faulting assumption.
The one place where this behavior does cause problems is with attributes whose values are XMLObjects (that is, whose values are known to be XML). Sans custom IdP extensions, this then can only affect eduPersonTargetedID attribute.
This problem is easily mitigated by constructing your filter policies such that that particular attribute is controlled by only one filter policy.
> Attribute value added multiple times to retained value set if multiple policies permit the same values
> ------------------------------------------------------------------------------------------------------
>
> Key: SC-162
> URL: https://issues.shibboleth.net/jira/browse/SC-162
> Project: Shibboleth Common - Java
> Issue Type: Bug
> Components: Attribute Authority
> Affects Versions: 1.3.0, 1.3.1, 1.3.3
> Environment: Tomcat6 on RHEL6, OpenJDK 1.6.0
> Reporter: vladimir.mencl at idp.protectnetwork.org
> Assignee: Chad La Joie
> Priority: Minor
> Fix For: 1.3.4
>
>
> After updating (luckily only a DEV box) from 2.3.2 to 2.3.3, we could test successfully against one SP, but ran into issues with another SP that was requesting "all" attributes:
> * On the uApprove screen, all attributes had their value listed twice
> * After confirming in uApprove (or bypassing uApprove on subsequent tries), we got the following error:
> https://idp-dev.cqu.edu.au/idp/profile/SAML2/Redirect/SSO
> {noformat}
> ERROR
> An error occurred while processing your request. Please contact your helpdesk or user ID office for assistance.
> This service requires cookies. Please ensure that they are enabled and try your going back to your desired resource and trying to login again.
> Use of your browser's back button may cause specific errors that can be resolved by going back to your desired resource and trying to login again.
> If you think you were sent here in error, please contact technical support
> {noformat}
> and the following stack-trace in {{idp-process.log}}:
> {noformat}
> 13:43:20.363 - INFO [Shibboleth-Access:74] - 20110802T034320Z|132.181.65.178|idp-dev.cqu.edu.au:443|/profile/SAML2/Redirect/SSO|
> 13:43:20.641 - ERROR [edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89] - Error occurred while processing request
> java.lang.IllegalArgumentException: {urn:oasis:names:tc:SAML:2.0:assertion}NameID is already the child of another XMLObject and may not be inserted in to this list
> at org.opensaml.xml.util.XMLObjectChildrenList.setParent(XMLObjectChildrenList.java:201) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:146) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.IndexedXMLObjectChildrenList.add(IndexedXMLObjectChildrenList.java:71) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:1) ~[xmltooling-1.3.2.jar:na]
> at java.util.AbstractList.add(AbstractList.java:108) ~[na:1.6.0_20]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:61) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:35) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.encodeAttributes(ShibbolethSAML2AttributeAuthority.java:211) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.buildAttributeStatement(ShibbolethSAML2AttributeAuthority.java:118) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildAttributeStatement(AbstractSAML2ProfileHandler.java:509) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:276) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) ~[shibboleth-common-1.3.3.jar:na]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Dispatcher.dispatchToIdP(Dispatcher.java:64) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.checkAccess(Plugin.java:202) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.doFilter(Plugin.java:119) [idp-plugin-2.2.1.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote-6.0.24.jar:na]
> at java.lang.Thread.run(Thread.java:636) [na:1.6.0_20]
> {noformat}
> We have worked-around this by down-grading to 2.3.2 - but this appears to be a critical blocker to me.
> Cheers,
> Vlad
> --
> Vladimir Mencl, Ph.D.
> E-Research Services and Systems Consultant
> BlueFern Computing Services
> University of Canterbury
> Private Bag 4800
> Christchurch 8140
> New Zealand
> http://www.bluefern.canterbury.ac.nz
> mailto:vladimir.mencl at canterbury.ac.nz
> Phone: +64 3 364 3012
> Mobile: +64 21 997 352
> Fax: +64 3 364 3002
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list