Bug in v3.3.0?

[Rhys Smith]

Hi guys,

A message from Phil Smart (who some of you know). He’s having issues joining the dev list, so until he manages to do so (bloody PhDs, can’t even join a mailing list), I said I’d forward on his question below:

I guess the question is - is this a bug? If y’all think so, I can tell him to just pop it onto Jira.

Rhys.


> Begin forwarded message:
> 
> From: Phil Smart <SmartP at cardiff.ac.uk>
> Subject: SEND THIS
> Date: 2 March 2017 at 14:36:35 GMT
> To: Rhys Smith <Rhys.Smith at jisc.ac.uk>
> 
> 
> 
> Hello,
> 
> I am trying to use a SubjectDerivedAttribute attribute definition in my attribute-resolver (Shib Idp v3.3.0) to return IdPAttributes contained within IdPAttributePrincipals. These are placed into the Subject’s principals when authenticating the principal inside a custom JAAS login module.
> 
> However, if the principalAttributeName can not be found (so there is no IdPAttribute with the same attributeId) I get a null pointer exception from the ContextDerivedAttributeDefinition e.g:
> 
> 
> 2017-03-01 14:17:09,972 - INFO [net.shibboleth.idp.attribute.resolver.ad.impl.ContextDerivedAttributeDefinition:107] - SubjectDerivedAttributeDefinitionsomeattribute generated no values, attrribute no resolved.
> 2017-03-01 14:17:09,975 - ERROR [net.shibboleth.idp.profile:-2] - Uncaught runtime exception
> java.lang.NullPointerException: null
>         at net.shibboleth.idp.attribute.resolver.ad.impl.ContextDerivedAttributeDefinition.doAttributeDefinitionResolve(ContextDerivedAttributeDefinition.java:98)
> 2017-03-01 14:17:09,996 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RuntimeException
> 
> 
> This (as the msg says) prevents further events from occurring. 
> 
> It is a valid state in our Identity System that some principals do not contain every SubjectDerivedAttribute defined in the resolver. Hence, this prevents some of them from authenticating. 
> 
> It looks to me from the stack trace (but I maybe wrong), that this is due to a debug statement in the ContextDerivedAttributeDefinition.doAttributeDefinitionResolve, which calls the size() method of the results object without first checking the results object is not null. It also appears that the net/shibboleth/idp/attribute/resolver/ad/impl/SubjectDerivedAttributeValuesFunction.class legally allows null values to return from the apply method - so perhaps should be dealt with. 
> 
> I include the relevant code fragments even though I am sure you can easily look this up:
> 
> 
> ———————net/shibboleth/idp/attribute/resolver/ad/impl/ContextDerivedAttributeDefinition.class
> 
> @Override @Nullable protected IdPAttribute doAttributeDefinitionResolve(
> 92
>             @Nonnull final AttributeResolutionContext resolutionContext,
> 93
>             @Nonnull final AttributeResolverWorkContext workContext) throws ResolutionException {
> 94
> 95
>         final ProfileRequestContext prc = prcLookupStrategy.apply(resolutionContext);
> 96
>         final List<IdPAttributeValue<?>> results = attributeValuesFunction.apply(prc);
> 97
>          
> //IS THIS THE ISSUE?
> 98
>         log.debug("{} Generated {} values.", getLogPrefix(), results.size());   
> 99
>         log.trace("{} Values:", getLogPrefix(), results);
> 100
>         final IdPAttribute attribute = new IdPAttribute(getId());
> 101
>         attribute.setValues(results);
> 102
>         return attribute;
> 103
>     } 
> 
> 
> ————net/shibboleth/idp/attribute/resolver/ad/impl/SubjectDerivedAttributeValuesFunction.class
> 
> @Nullable
>   public List<IdPAttributeValue<?>> apply(@Nullable ProfileRequestContext prc)
>   {
>     SubjectContext cs = (SubjectContext)this.scLookupStrategy.apply(prc);
>     List<IdPAttributeValue<?>> results = new ArrayList(1);
>     for (Subject subject : cs.getSubjects()) {
>       for (Principal principal : subject.getPrincipals())
>       {
>         List<IdPAttributeValue<?>> values = (List)this.attributesValueFunction.apply(principal);
>         if ((null != values) && (!values.isEmpty())) {
>           results.addAll(values);
>         }
>       }
>     }
>     if (results.isEmpty())
>     {
>       this.log.info <http://this.log.info/>("{} generated no values, attrribute no resolved.", getLogPrefix());
>       return null;
>     }
>     this.log.debug("{} Generated {} values.", getLogPrefix(), Integer.valueOf(results.size()));
>     this.log.trace("{} Values:", getLogPrefix(), results);
>     return results;
>   }
> 
> 
> 
> Thanks
> 
> Phil
> 

--
Dr Rhys Smith
Chief Technical Architect, Trust & Identity
Jisc

T: +44 (0) 1235 822145
M: +44 (0) 7968 087821
Skype: rhys-smith
GPG: 0x4638C985
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG

jisc.ac.uk <http://jisc.ac.uk/>

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170302/fbd54cf5/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3859 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20170302/fbd54cf5/attachment-0001.p7s>