[JIRA] Commented: (SC-162) Attribute value added multiple times to retained value set if multiple policies permit the same values
vladimir.mencl@idp.protectnetwork.org (JIRA)
noreply at shibboleth.net
Wed Aug 3 06:31:25 BST 2011
[ https://issues.shibboleth.net/jira/browse/SC-162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13456#comment-13456 ]
vladimir.mencl at idp.protectnetwork.org commented on SC-162:
----------------------------------------------------------
Hi Scott,
That is a new thing to me that an overlap in the attribute filter policies (saying multiple times this attribute MAY be released) causes the attribute value to be released multiple times.
This wasn't happening up until 2.3.2 (inclusive) and appears to be a regression in 2.3.3 (which appears to have been released to fix something closely related).
Note that uApprove is not to be blamed - I get the behavior even with uApprove out of the way (see the /Shibboleth.sso/Session snippet in my previous post).
Are you saying that releasing the attribute value multiple times (with overlapping policies like I happened to get) would be correct behavior (which just wasn't happening until 2.3.3) ? This would be putting a rather heavy burden on IdP admins not to create any overlaps in their attribute filter policies. An overlap can happen very easily - e.g., releasing one attribute to the whole federation, and then releasing attributes per SP.
Thanks for looking into this.
Cheers,
Vlad
> Attribute value added multiple times to retained value set if multiple policies permit the same values
> ------------------------------------------------------------------------------------------------------
>
> Key: SC-162
> URL: https://issues.shibboleth.net/jira/browse/SC-162
> Project: Shibboleth Common - Java
> Issue Type: Bug
> Components: Attribute Authority
> Affects Versions: 1.3.0, 1.3.1, 1.3.3
> Environment: Tomcat6 on RHEL6, OpenJDK 1.6.0
> Reporter: vladimir.mencl at idp.protectnetwork.org
> Assignee: Chad La Joie
> Priority: Minor
> Fix For: 1.3.4
>
> Attachments: IdP-2.3.3-uApprove-all-attributes-duplicate.png, IdP-2.3.3-uApprove-some-attributes-duplicate.png
>
>
> After updating (luckily only a DEV box) from 2.3.2 to 2.3.3, we could test successfully against one SP, but ran into issues with another SP that was requesting "all" attributes:
> * On the uApprove screen, all attributes had their value listed twice
> * After confirming in uApprove (or bypassing uApprove on subsequent tries), we got the following error:
> https://idp-dev.cqu.edu.au/idp/profile/SAML2/Redirect/SSO
> {noformat}
> ERROR
> An error occurred while processing your request. Please contact your helpdesk or user ID office for assistance.
> This service requires cookies. Please ensure that they are enabled and try your going back to your desired resource and trying to login again.
> Use of your browser's back button may cause specific errors that can be resolved by going back to your desired resource and trying to login again.
> If you think you were sent here in error, please contact technical support
> {noformat}
> and the following stack-trace in {{idp-process.log}}:
> {noformat}
> 13:43:20.363 - INFO [Shibboleth-Access:74] - 20110802T034320Z|132.181.65.178|idp-dev.cqu.edu.au:443|/profile/SAML2/Redirect/SSO|
> 13:43:20.641 - ERROR [edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89] - Error occurred while processing request
> java.lang.IllegalArgumentException: {urn:oasis:names:tc:SAML:2.0:assertion}NameID is already the child of another XMLObject and may not be inserted in to this list
> at org.opensaml.xml.util.XMLObjectChildrenList.setParent(XMLObjectChildrenList.java:201) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:146) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.IndexedXMLObjectChildrenList.add(IndexedXMLObjectChildrenList.java:71) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:1) ~[xmltooling-1.3.2.jar:na]
> at java.util.AbstractList.add(AbstractList.java:108) ~[na:1.6.0_20]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:61) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:35) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.encodeAttributes(ShibbolethSAML2AttributeAuthority.java:211) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.buildAttributeStatement(ShibbolethSAML2AttributeAuthority.java:118) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildAttributeStatement(AbstractSAML2ProfileHandler.java:509) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:276) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) ~[shibboleth-common-1.3.3.jar:na]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Dispatcher.dispatchToIdP(Dispatcher.java:64) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.checkAccess(Plugin.java:202) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.doFilter(Plugin.java:119) [idp-plugin-2.2.1.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote-6.0.24.jar:na]
> at java.lang.Thread.run(Thread.java:636) [na:1.6.0_20]
> {noformat}
> We have worked-around this by down-grading to 2.3.2 - but this appears to be a critical blocker to me.
> Cheers,
> Vlad
> --
> Vladimir Mencl, Ph.D.
> E-Research Services and Systems Consultant
> BlueFern Computing Services
> University of Canterbury
> Private Bag 4800
> Christchurch 8140
> New Zealand
> http://www.bluefern.canterbury.ac.nz
> mailto:vladimir.mencl at canterbury.ac.nz
> Phone: +64 3 364 3012
> Mobile: +64 21 997 352
> Fax: +64 3 364 3002
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list