[JIRA] Commented: (SC-162) Attribute value added multiple times to retained value set if multiple policies permit the same values
Scott Cantor (JIRA)
noreply at shibboleth.net
Thu Oct 6 22:35:25 BST 2011
[ https://issues.shibboleth.net/jira/browse/SC-162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13609#comment-13609 ]
Scott Cantor commented on SC-162:
---------------------------------
The behavior in the IDP is described in this bug entry, it's when multiple policies release the same attribute.
The point is that the SP cannot tell that, and cannot assume anything about the meaning of multiple identical values because that is not supported by SAML. They could be duplicates or they could be meaningful, and unless you get guarantees outside of the standard, neither is presumed.
> Attribute value added multiple times to retained value set if multiple policies permit the same values
> ------------------------------------------------------------------------------------------------------
>
> Key: SC-162
> URL: https://issues.shibboleth.net/jira/browse/SC-162
> Project: Shibboleth Common - Java
> Issue Type: Bug
> Components: Attribute Authority
> Affects Versions: 1.3.0, 1.3.1, 1.3.3
> Environment: Tomcat6 on RHEL6, OpenJDK 1.6.0
> Reporter: vladimir.mencl at idp.protectnetwork.org
> Assignee: Chad La Joie
> Priority: Minor
> Fix For: 1.3.4
>
> Attachments: IdP-2.3.3-uApprove-all-attributes-duplicate.png, IdP-2.3.3-uApprove-some-attributes-duplicate.png
>
>
> After updating (luckily only a DEV box) from 2.3.2 to 2.3.3, we could test successfully against one SP, but ran into issues with another SP that was requesting "all" attributes:
> * On the uApprove screen, all attributes had their value listed twice
> * After confirming in uApprove (or bypassing uApprove on subsequent tries), we got the following error:
> https://idp-dev.cqu.edu.au/idp/profile/SAML2/Redirect/SSO
> {noformat}
> ERROR
> An error occurred while processing your request. Please contact your helpdesk or user ID office for assistance.
> This service requires cookies. Please ensure that they are enabled and try your going back to your desired resource and trying to login again.
> Use of your browser's back button may cause specific errors that can be resolved by going back to your desired resource and trying to login again.
> If you think you were sent here in error, please contact technical support
> {noformat}
> and the following stack-trace in {{idp-process.log}}:
> {noformat}
> 13:43:20.363 - INFO [Shibboleth-Access:74] - 20110802T034320Z|132.181.65.178|idp-dev.cqu.edu.au:443|/profile/SAML2/Redirect/SSO|
> 13:43:20.641 - ERROR [edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89] - Error occurred while processing request
> java.lang.IllegalArgumentException: {urn:oasis:names:tc:SAML:2.0:assertion}NameID is already the child of another XMLObject and may not be inserted in to this list
> at org.opensaml.xml.util.XMLObjectChildrenList.setParent(XMLObjectChildrenList.java:201) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:146) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.IndexedXMLObjectChildrenList.add(IndexedXMLObjectChildrenList.java:71) ~[xmltooling-1.3.2.jar:na]
> at org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:1) ~[xmltooling-1.3.2.jar:na]
> at java.util.AbstractList.add(AbstractList.java:108) ~[na:1.6.0_20]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:61) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:35) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.encodeAttributes(ShibbolethSAML2AttributeAuthority.java:211) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.buildAttributeStatement(ShibbolethSAML2AttributeAuthority.java:118) ~[shibboleth-common-1.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildAttributeStatement(AbstractSAML2ProfileHandler.java:509) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:276) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) ~[shibboleth-identityprovider-2.3.3.jar:na]
> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) ~[shibboleth-common-1.3.3.jar:na]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Dispatcher.dispatchToIdP(Dispatcher.java:64) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.checkAccess(Plugin.java:202) [idp-plugin-2.2.1.jar:na]
> at ch.SWITCH.aai.uApprove.idpplugin.Plugin.doFilter(Plugin.java:119) [idp-plugin-2.2.1.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.3.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote-6.0.24.jar:na]
> at java.lang.Thread.run(Thread.java:636) [na:1.6.0_20]
> {noformat}
> We have worked-around this by down-grading to 2.3.2 - but this appears to be a critical blocker to me.
> Cheers,
> Vlad
> --
> Vladimir Mencl, Ph.D.
> E-Research Services and Systems Consultant
> BlueFern Computing Services
> University of Canterbury
> Private Bag 4800
> Christchurch 8140
> New Zealand
> http://www.bluefern.canterbury.ac.nz
> mailto:vladimir.mencl at canterbury.ac.nz
> Phone: +64 3 364 3012
> Mobile: +64 21 997 352
> Fax: +64 3 364 3002
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list