[JIRA] (IDP-2075) IdP logs message at WARN when attribute filter returns no values after filtering

[Keith Wessel (Jira)]

Keith Wessel ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad392bb4624d00692388ed ) *commented* on IDP-2075 ( https://shibboleth.atlassian.net/browse/IDP-2075?atlOrigin=eyJpIjoiMjIxMWQyM2RlNzNmNDQ3NDlmOThlOWI2MTkyYjI5YTUiLCJwIjoiaiJ9 )

Re: IdP logs message at WARN when attribute filter returns no values after filtering ( https://shibboleth.atlassian.net/browse/IDP-2075?atlOrigin=eyJpIjoiMjIxMWQyM2RlNzNmNDQ3NDlmOThlOWI2MTkyYjI5YTUiLCJwIjoiaiJ9 )

If that’s the case then yes, something definitely isn’t getting logged. FWIW, a very common message was coming out of the OIDC extension back in 2019 that I reported on the list:

http://shibboleth.net/pipermail/users/2019-September/045088.html ( https://urldefense.com/v3/__http:/shibboleth.net/pipermail/users/2019-September/045088.html__;!!DZ3fjg!_i3UT0eUCGp5zXCwEy-mV5R0tcMQBtjjGjq-Ge7O4vS8zYsa_nnxL2JvAuOu1I0Nr4lFHk7L5O7iGTfuFxM$ )

I don’t see those messages any more, but the comment in my logback.xml above the filter that I added to remove messages with the “filter failed.” syntax says that I added it to remove OIDC noise. UIC first saw these this morning when a SAML SP was requesting authentication, and it seemed to be coming from their OIDC requested_claims filter designed to release specific claims included in the OIDC requestClaims parameter. That is, it looked to UIC like it was choaking on OIDC-specific filters when a SAML SP was making the request. Digging deeper, that seems to be the case here, too. I have seven attributes mentioned in my requested_claims attribute filter, and those are the ones throwing this error. My filter is:

<AttributeFilterPolicy id="REQUESTED_CLAIMS">
   <PolicyRequirementRule xsi:type="OR">
       <Rule xsi:type="NOT">
           <Rule xsi:type="Value" attributeID="iTrustSuppress"
               value="true"/>
       </Rule>
       <Rule xsi:type="EntityAttributeExactMatch"
           attributeName="urn:mace:incommon:uiuc.edu:attribute-release"
           attributeValue="urn:mace:incommon:uiuc.edu:attribute-release:allow-ferpa-suppressed"/>
   </PolicyRequirementRule>

   <AttributeRule attributeID="eduPersonAffiliation">
       <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true" />
   </AttributeRule>
   <AttributeRule attributeID="eduPersonPrimaryAffiliation">
       <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true" />
   </AttributeRule>
   <AttributeRule attributeID="eduPersonPrincipalName">
       <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" />
   </AttributeRule>
   <AttributeRule attributeID="mail">
       <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" />
   </AttributeRule>
   <AttributeRule attributeID="displayName">
       <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true"
           onlyIfEssential="true" />
   </AttributeRule>
           <AttributeRule attributeID="uiucEduUIN">
           <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true"
               onlyIfEssential="true" />
       </AttributeRule>
       <AttributeRule attributeID="uiucEduRole">
           <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true" />
       </AttributeRule>
   </AttributeFilterPolicy>

Keith

( https://shibboleth.atlassian.net/browse/IDP-2075#add-comment?atlOrigin=eyJpIjoiMjIxMWQyM2RlNzNmNDQ3NDlmOThlOWI2MTkyYjI5YTUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2075#add-comment?atlOrigin=eyJpIjoiMjIxMWQyM2RlNzNmNDQ3NDlmOThlOWI2MTkyYjI5YTUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100216- sha1:64a4cf6 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230222/09adc1fc/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-18fb3070-758c-4c66-a915-d594edf55ed8
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230222/09adc1fc/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-8bfdb479-743e-4dd1-839a-19bfdca6d2e6
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230222/09adc1fc/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-72462cd7-a23e-44a6-af59-dc33def632db
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230222/09adc1fc/attachment-0005.png>