SAML2 Attribute Query and CryptoTransientId

[Tom Poage]

Resolution.

I'd left pc:Transient PrincipalConnectors uncommented in
attribute-resolver.xml. I.e.

> <resolver:PrincipalConnector xsi:type="pc:Transient" id="shibTransient" nameIDFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
> <resolver:PrincipalConnector xsi:type="pc:Transient" id="saml1Unspec" nameIDFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
> <resolver:PrincipalConnector xsi:type="pc:Transient" id="saml2Transient" nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
> <resolver:PrincipalConnector xsi:type="pc:CryptoTransient" id="shibCrypto" dataSealerRef="shibboleth.TransientIDDataSealer" nameIDFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
> <resolver:PrincipalConnector xsi:type="pc:CryptoTransient" id="saml2Crypto" dataSealerRef="shibboleth.TransientIDDataSealer" nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>

Turns out, when using SAML 1 attribute query the principal connector
lookup mapped to the "shibCrypto" CryptoTransient PC, but a SAML 2
attribute query mapped to the "saml2Transient" Transient PC (having no
data). First element in a (hash) set? Dunno. Didn't look at the code.

Anyhow, commenting out the pc:Transient PCs fixed the problem and AQ
works as intended. Oops.

Tom.

On 07/28/2011 03:35 PM, Cantor, Scott E. wrote:
> On 7/28/11 5:03 PM, "Tom Poage" <tfpoage at ucdavis.edu> wrote:
>> This is what I was using for testing (along with corresponding
>> AttributeDefinition):
> 
> Ok, just a thought.
> 
>> Not a big deal (for me), since we don't use SAML 2 Attribute Query, nor
>> Artifact in general.
> 
> I don't at all, so it may be there's a bug handling 2.0, though I can't
> think why. That code's all far away from any of the SAML version specific
> code. I would suggest filing a bug on it for now. I can try it easily
> enough once I have a chance.
> 
>> That said, we were toying with the idea of reinstating AQ for SAML 1
>> (vs. push) cf. the security consideration of pushing unencrypted
>> attributes through the client browser (and I've been avoiding Terracotta).
> 
> I'm using it now for SAML 1 (we just went production this week).
> 
> As an aside, I probably was the last thing resembling a maintainer for the
> 1.3 IdP, so if somebody out there is still using it, I suggest you find
> yourself a sugar daddy to maintain that code.
> 
> -- Scott
>