duplicate attribute value issue in idp 2.3.3

[Arjuna Scagnetto]

found out.

the problem for my case is in attribute-filter


seems that idp2.3.3 doesn't like a duplicate release rule for
eduPersonTargetedID. This example doesn't work

<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY" />

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="eduPersonTargetedID">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>


    <afp:AttributeFilterPolicy id="releaseToSpTestGarr">
        <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="https://somesp.it/" />


        <afp:AttributeRule attributeID="eduPersonTargetedID">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>


this works


<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY" />

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>


    <afp:AttributeFilterPolicy id="releaseToSpTestGarr">
        <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="https://somesp.it/" />


        <afp:AttributeRule attributeID="eduPersonTargetedID">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>


i hope could be your problem too
bye
Arjuna

On 02/08/2011 14.19, Chad La Joie wrote:
> If its truly unintentional that you need to figure out who hacked your
> IdP and added in extra data connectors.
> 
> But again, it doesn't matter, there is no guarantee, and never has
> been, that the IdP won't release duplicate values.  Nor does the SP.
> Nor does the SAML spec require it.  So if the app is breaking because
> it receives duplicate values then it has a bug.
> 
> On Tue, Aug 2, 2011 at 08:14, Leif Johansson <leifj at sunet.se> wrote:
> On 08/02/2011 02:01 PM, Chad La Joie wrote:
>>>> There was some code in the IdP before that was de-duplicating values
>>>> incorrectly and causing another bug.  That code has been removed.
>>>> That code was there strictly as a performance optimization (less
>>>> values to have to evaluate and potentially encode).  However, we've
>>>> never said that the IdP will never release duplicates if you supply it
>>>> with duplicates.  If your application breaks because it finds the same
>>>> value more than once then you need to fix the application.
> 
> Since its static values it doesn't sound like Viljo is (un)intentionally
> giving the resolver duplicate values.
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>
> 
> 
>