duplicate attribute value issue in idp 2.3.3

[Chad La Joie]

Okay, that would be a bug and I don't think my test environment has
any cases where multiple policies cover overlapping attributes, so
that would be why I didn't see it.

On Tue, Aug 2, 2011 at 09:15, Arjuna Scagnetto <ascagnetto at units.it> wrote:
> found out.
>
> the problem for my case is in attribute-filter
>
>
> seems that idp2.3.3 doesn't like a duplicate release rule for
> eduPersonTargetedID. This example doesn't work
>
> <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
>        <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>
>        <afp:AttributeRule attributeID="transientId">
>            <afp:PermitValueRule xsi:type="basic:ANY" />
>        </afp:AttributeRule>
>
>        <afp:AttributeRule attributeID="eduPersonTargetedID">
>            <afp:PermitValueRule xsi:type="basic:ANY" />
>        </afp:AttributeRule>
>
>    </afp:AttributeFilterPolicy>
>
>
>    <afp:AttributeFilterPolicy id="releaseToSpTestGarr">
>        <afp:PolicyRequirementRule
> xsi:type="basic:AttributeRequesterString" value="https://somesp.it/" />
>
>
>        <afp:AttributeRule attributeID="eduPersonTargetedID">
>            <afp:PermitValueRule xsi:type="basic:ANY" />
>        </afp:AttributeRule>
>
>    </afp:AttributeFilterPolicy>
>
>
> this works
>
>
> <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
>        <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>
>        <afp:AttributeRule attributeID="transientId">
>            <afp:PermitValueRule xsi:type="basic:ANY" />
>        </afp:AttributeRule>
>
>    </afp:AttributeFilterPolicy>
>
>
>    <afp:AttributeFilterPolicy id="releaseToSpTestGarr">
>        <afp:PolicyRequirementRule
> xsi:type="basic:AttributeRequesterString" value="https://somesp.it/" />
>
>
>        <afp:AttributeRule attributeID="eduPersonTargetedID">
>            <afp:PermitValueRule xsi:type="basic:ANY" />
>        </afp:AttributeRule>
>
>    </afp:AttributeFilterPolicy>
>
>
> i hope could be your problem too
> bye
> Arjuna
>
> On 02/08/2011 14.19, Chad La Joie wrote:
>> If its truly unintentional that you need to figure out who hacked your
>> IdP and added in extra data connectors.
>>
>> But again, it doesn't matter, there is no guarantee, and never has
>> been, that the IdP won't release duplicate values.  Nor does the SP.
>> Nor does the SAML spec require it.  So if the app is breaking because
>> it receives duplicate values then it has a bug.
>>
>> On Tue, Aug 2, 2011 at 08:14, Leif Johansson <leifj at sunet.se> wrote:
>> On 08/02/2011 02:01 PM, Chad La Joie wrote:
>>>>> There was some code in the IdP before that was de-duplicating values
>>>>> incorrectly and causing another bug.  That code has been removed.
>>>>> That code was there strictly as a performance optimization (less
>>>>> values to have to evaluate and potentially encode).  However, we've
>>>>> never said that the IdP will never release duplicates if you supply it
>>>>> with duplicates.  If your application breaks because it finds the same
>>>>> value more than once then you need to fix the application.
>>
>> Since its static values it doesn't sound like Viljo is (un)intentionally
>> giving the resolver duplicate values.
>>> --
>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>>
>>
>>
>>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered