[JIRA] (IDP-1938) c14n for PrincipalName differs in behaviour for saml proxying between v4.1.6 and v4.2.0-20220404.011450-293

Fri Apr 8 21:44:34 UTC 2022

Chris.Phillips at canarie.ca ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ad9c5b0aa-4ee5-45bd-b913-57fd7ee7e854 ) *commented* on IDP-1938 ( https://shibboleth.atlassian.net/browse/IDP-1938?atlOrigin=eyJpIjoiNDdhYzU5N2NiOTI0NGIwNzg4MjRmMDg5YjdhZDkzZjYiLCJwIjoiaiJ9 )

Re: c14n for PrincipalName differs in behaviour for saml proxying between v4.1.6 and v4.2.0-20220404.011450-293 ( https://shibboleth.atlassian.net/browse/IDP-1938?atlOrigin=eyJpIjoiNDdhYzU5N2NiOTI0NGIwNzg4MjRmMDg5YjdhZDkzZjYiLCJwIjoiaiJ9 )

Hi. I’m struggling a bit on properly invoking the shibboleth.c14n.simple.Transforms bean in subject-c14n.xml and am looking for an example to work from. I see referrence to older v3 syntax and my outcome is to run the regex on the value using the Pair method – if that’s the right way

I see this doc, but no clear example on how to invoke the simple transforms. https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631621/SimplePostLoginC14NConfiguration and the older v3 items reference this page too.

As you’ve seen earlier today, I’m trying to massage the inbound attribute to be broken down from the scope but have no example to run from.

where in the subject-c14n.xml do I need to invoke the transform?

I added this at the end:

<util:list id="shibboleth.c14n.simple.Transforms">

<bean parent="shibboleth.Pair" p:first="^(.+)@canarie
.ca$" p:second="$1" />

</util:list>

and in a different approach I had that in simple-subject-c14-config.xml but it did not process things as expected.

Am I hitting an issue with the regex handling a scoped attribute that won’t match the regex above or am I just a hot mess on the syntax and location it’s needed?

Thanks in advance. Here’s what I see in the logs on things.

2022-04-08 14:38:18,320 - 192.168.56.1 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/attribute
2022-04-08 14:38:18,419 - 192.168.56.1 - DEBUG [net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization:236] - Profile Action AttributeSourcedSubjectCanonicalization: Using attribute azureName scoped value cphillips at canarie.ca as input to transforms
2022-04-08 14:38:18,419 - 192.168.56.1 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:221] - Profile Action AttributeSourcedSubjectCanonicalization: trimming whitespace of input string 'cphillips at canarie.ca'
2022-04-08 14:38:18,424 - 192.168.56.1 - DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:168] - Profile Action DetectIdentitySwitch: Identities from session and new authentication result match, nothing to do
2022-04-08 14:38:18,426 - 192.168.56.1 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:116] - Profile Action FinalizeAuthentication: Canonical principal name was established as 'cphillips at canarie.ca'

( https://shibboleth.atlassian.net/browse/IDP-1938#add-comment?atlOrigin=eyJpIjoiNDdhYzU5N2NiOTI0NGIwNzg4MjRmMDg5YjdhZDkzZjYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1938#add-comment?atlOrigin=eyJpIjoiNDdhYzU5N2NiOTI0NGIwNzg4MjRmMDg5YjdhZDkzZjYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/553a5520/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-c616d03d-f29e-42a4-9e26-0756f84c91f7
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/553a5520/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-75d1b74c-3582-4310-adb6-b868ed0b9eb7
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/553a5520/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-5885d8c4-27e0-4e1b-8e65-6f7fbbea86fb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/553a5520/attachment-0005.png>