What is the hash of a null-type attribute value?

Rod Widdowson rdw at steadingsoftware.com
Wed Nov 6 08:41:36 EST 2019


Probably Tom and/or Scott:

I was going to put this into JIRA but a discussion here will be easier.  

I discovered while de-guava-ing the consent modules that net.shibboleth.idp.consent.logic.impl.AttributeValuesHashFunction was
annotated (and coded) to accept a @NullableElements Collection<IdPAttributeValue> parameter

The annotation is clearly incorrect since we haven't support null as an attribute value ever and explicitly since the early V3s.
Changing the code then threw a test failure against exactly this, which again is not unusual.

But then I got smart and decided to change the test to insert an EmptyAttributeValue.NULL element and it still failed.  Which is
also fine.

But I got to wondering what the correct behaviour of this hashing function should be in the presence of the empty attributes.   And
the answer is that I just don't know.

What the code currently does is accumulate all the values into a ByteArrayOutputStream wrapped inside an ObjectOutputStream, with
Scoped, String and XML attribute values all being serialized by special purpose code.  Everything else then falls into
value.getNativeValue().   When the accumulation is complete the result is base 64 converted.

I don't know what the hash is used for but AFAICS we end up with something which may be JVM (and possible instance of JVM) specific.
On my VM it appears to be some sort of line noise followed by the enum value
(net.shibboleth.idp.attribute.EmptyAttributeValue$NullAttribute) but I'm assuming that that isn't specified anywhere.  So it strikes
me that we need a special case EmptyAttributeValues since this is probably an "On Disk Format" and so unchanging, but I am not
really sure what it should be.

Then there is the philosophical question "What is the difference between a value that isn't there and one that is explicitly not
there".  And the pragmatic one that this function will never see such values.

For now I'll supress the test and move on.

	/Rod



More information about the dev mailing list