duplicate attribute value issue in idp 2.3.3

Tue Aug 2 13:49:30 BST 2011

this is the error with configs copied from idp2.3.2

14:49:33.840 - ERROR
[edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89]
- Error occurred while processing request
java.lang.IllegalArgumentException:
{urn:oasis:names:tc:SAML:2.0:assertion}NameID is already the child of
another XMLObject and may not be inserted in to this list
        at
org.opensaml.xml.util.XMLObjectChildrenList.setParent(XMLObjectChildrenList.java:201)
~[xmltooling-1.3.2.jar:na]
        at
org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:146)
~[xmltooling-1.3.2.jar:na]
        at
org.opensaml.xml.util.IndexedXMLObjectChildrenList.add(IndexedXMLObjectChildrenList.java:71)
~[xmltooling-1.3.2.jar:na]
        at
org.opensaml.xml.util.XMLObjectChildrenList.add(XMLObjectChildrenList.java:1)
~[xmltooling-1.3.2.jar:na]
        at java.util.AbstractList.add(AbstractList.java:91) ~[na:1.6.0_26]
        at
edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:61)
~[shibboleth-common-1.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder.encode(SAML2XMLObjectAttributeEncoder.java:35)
~[shibboleth-common-1.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.encodeAttributes(ShibbolethSAML2AttributeAuthority.java:211)
~[shibboleth-common-1.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.buildAttributeStatement(ShibbolethSAML2AttributeAuthority.java:118)
~[shibboleth-common-1.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildAttributeStatement(AbstractSAML2ProfileHandler.java:509)
~[shibboleth-identityprovider-2.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:276)
~[shibboleth-identityprovider-2.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165)
~[shibboleth-identityprovider-2.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88)
~[shibboleth-identityprovider-2.3.3.jar:na]
        at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84)
~[shibboleth-common-1.3.3.jar:na]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
        at
ch.SWITCH.aai.uApprove.idpplugin.Dispatcher.dispatchToIdP(Dispatcher.java:64)
[idp-plugin-2.2.1.jar:na]
        at
ch.SWITCH.aai.uApprove.idpplugin.Plugin.checkAccess(Plugin.java:202)
[idp-plugin-2.2.1.jar:na]
        at
ch.SWITCH.aai.uApprove.idpplugin.Plugin.doFilter(Plugin.java:119)
[idp-plugin-2.2.1.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
        at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.3.3.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
        at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81)
[shibboleth-identityprovider-2.3.3.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
        at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common-1.3.3.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
[catalina.jar:6.0.32]
        at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
[catalina.jar:6.0.32]
        at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
[catalina.jar:6.0.32]
        at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
[catalina.jar:6.0.32]
        at
org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
[tomcat-coyote.jar:6.0.32]
        at
org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291)
[tomcat-coyote.jar:6.0.32]
        at
org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:776)
[tomcat-coyote.jar:6.0.32]
        at
org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:705)
[tomcat-coyote.jar:6.0.32]
        at
org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898)
[tomcat-coyote.jar:6.0.32]
        at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)
[tomcat-coyote.jar:6.0.32]
        at java.lang.Thread.run(Thread.java:662) [na:1.6.0_26]

On 02/08/2011 14.19, Chad La Joie wrote:
> If its truly unintentional that you need to figure out who hacked your
> IdP and added in extra data connectors.
> 
> But again, it doesn't matter, there is no guarantee, and never has
> been, that the IdP won't release duplicate values.  Nor does the SP.
> Nor does the SAML spec require it.  So if the app is breaking because
> it receives duplicate values then it has a bug.
> 
> On Tue, Aug 2, 2011 at 08:14, Leif Johansson <leifj at sunet.se> wrote:
> On 08/02/2011 02:01 PM, Chad La Joie wrote:
>>>> There was some code in the IdP before that was de-duplicating values
>>>> incorrectly and causing another bug.  That code has been removed.
>>>> That code was there strictly as a performance optimization (less
>>>> values to have to evaluate and potentially encode).  However, we've
>>>> never said that the IdP will never release duplicates if you supply it
>>>> with duplicates.  If your application breaks because it finds the same
>>>> value more than once then you need to fix the application.
> 
> Since its static values it doesn't sound like Viljo is (un)intentionally
> giving the resolver duplicate values.
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>
> 
> 
>