[JIRA] Commented: (SC-162) Attribute value added multiple times to retained value set if multiple policies permit the same values
Scott Cantor (JIRA)
noreply at shibboleth.net
Wed Aug 3 05:02:25 BST 2011
[ https://issues.shibboleth.net/jira/browse/SC-162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13455#comment-13455 ]
Scott Cantor commented on SC-162:
---------------------------------
The basic point is that the only bug here is the one caused by the overlap in policies, which only applies commonly in the SAML 2.0 case when using ePTID in the non-suggested way, as an attribute value. It should be in the NameID. So it's relatively simple to work around until V3.
The duplication display thing is a bug in uApprove. The SP will also not provide any de-duplication logic, and never has. It's worked that way since the first release.
> Attribute value added multiple times to retained value set if multiple policies permit the same values
> ------------------------------------------------------------------------------------------------------
>
> Key: SC-162
> URL: https://issues.shibboleth.net/jira/browse/SC-162
> Project: Shibboleth Common - Java
> Issue Type: Bug
> Components: Attribute Authority
> Affects Versions: 1.3.0, 1.3.1, 1.3.3
> Environment: Tomcat6 on RHEL6, OpenJDK 1.6.0
> Reporter: vladimir.mencl at idp.protectnetwork.org
> Assignee: Chad La Joie
> Priority: Minor
> Fix For: 1.3.4
>
> Attachments: IdP-2.3.3-uApprove-all-attributes-duplicate.png, IdP-2.3.3-uApprove-some-attributes-duplicate.png
>
>
> After updating (luckily only a DEV box) from 2.3.2 to 2.3.3, we could test successfully against one SP, but ran into issues with another SP that was requesting "all" attributes:
> * On the uApprove screen, all attributes had their value listed twice
> * After confirming in uApprove (or bypassing uApprove on subsequent tries), we got the following error:
> https://idp-dev.cqu.edu.au/idp/profile/SAML2/Redirect/SSO
> {noformat}
> ERROR
> An error occurred while processing your request. Please contact your helpdesk or user ID office for assistance.
> This service requires cookies. Please ensure that they are enabled and try your going back to your desired resource and trying to login again.
> Use of your browser's back button may cause specific errors that can be resolved by going back to your desired resource and trying to login again.
> If you think you were sent here in error, please contact technical support
> {noformat}
> and the following stack-trace in {{idp-process.log}}:
> {noformat}
> 13:43:20.363 - INFO [Shibboleth-Access:74] - 20110802T034320Z|132.181.65.178|idp-dev.cqu.edu.au:443|/profile/SAML2/Redirect/SSO|
> 13:43:20.641 - ERROR [edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89] - Error occurred while processing request
> java.lang.IllegalArgumentException: {urn:oasis:names:tc:SAML:2.0:assertion}NameID is already the child of another XMLObject and may not be inserted in to this list
> at org.opensaml.xml.util.XMLObjectChildrenList.setParent(XMLObjectChildrenList.java:201) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:146) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.IndexedXMLObjectChildrenList.add(IndexedXMLObjectChildrenList.java:71) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:1) ~[xmltooling-1.3.2.jar:na]
> at java.util.AbstractList.add(AbstractList.java:108) ~[na:1.6.0_20]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:61) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:35) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.encodeAttributes(ShibbolethSAML2AttributeAuthority.java:211) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.buildAttributeStatement(ShibbolethSAML2AttributeAuthority.java:118) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildAttributeStatement(AbstractSAML2ProfileHandler.java:509) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:276) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) ~[shibboleth-common-1.3.3.jar:na]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Dispatcher.dispatchToIdP(Dispatcher.java:64) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.checkAccess(Plugin.java:202) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.doFilter(Plugin.java:119) [idp-plugin-2.2.1.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote-6.0.24.jar:na]
> at java.lang.Thread.run(Thread.java:636) [na:1.6.0_20]
> {noformat}
> We have worked-around this by down-grading to 2.3.2 - but this appears to be a critical blocker to me.
> Cheers,
> Vlad
> --
> Vladimir Mencl, Ph.D.
> E-Research Services and Systems Consultant
> BlueFern Computing Services
> University of Canterbury
> Private Bag 4800
> Christchurch 8140
> New Zealand
> http://www.bluefern.canterbury.ac.nz
> mailto:vladimir.mencl at canterbury.ac.nz
> Phone: +64 3 364 3012
> Mobile: +64 21 997 352
> Fax: +64 3 364 3002
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list