Multi-valued attributes - some values not encoded by IdP?

[Phil Chapman]

Hi Chad,

Increasing the IdP's log level from INFO to DEBUG was the first thing I tried.  (If there are separate log level settings for the resolver and filter engine, then I can't see them in any of the config files...)

The log definitely says "Resolved attribute eduPersonScopedAffiliation containing 3 values"

It then goes on to show lines such as "Removing duplicate value staff of attribute eduPersonPrimaryAffiliation from resolution result" - but there are no lines like this for eduPersonScopedAffiliation.

There's nothing adjacent to "Processing permit value rule for attribute eduPersonScopedAffiliation for principal <username>" which suggests that values have been rejected.

When the log gets to the point of "Filtered attributes for principal <username>.  The following attributes remain:", eduPersonScopedAffiliation *does* appear.

I then see "Encoded attribute eduPersonScopedAffiliation with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2ScopedStringAttributeEncoder"

I don't think "Removing attribute eduPersonScopedAffiliation, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder" is relevant...?

In the dump of the attribute statement, I see:

      <saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">staff at department1.establishment.org.uk</saml2:AttributeValue>
      </saml2:Attribute>

So values staff at department2.establishment.org.uk and staff at department3.establishment.org.uk haven't been encoded.

Just a thought: is it possible that values 2 and 3 are eliminated because the bit before the scope is the same for all three values?  The absence of any "Removing duplicate value staff of attribute eduPersonScopedAffiliation from resolution result" suggests this isn't the case, but it's the only reason I can imagine why eduPersonScopedAffiliation ends up with one value while Entitlement (with three very different values) retains all three.

Thanks for your help,
Phil.

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
> On Behalf Of Chad La Joie
> Sent: 12 August 2011 18:36
> To: Shib Users
> Subject: Re: Multi-valued attributes - some values not encoded by IdP?
> 
> You'll need to turn on debug logging for the resolver and filter engine.
> 
> On Fri, Aug 12, 2011 at 13:13, Phil Chapman <phil at atomwide.com> wrote:
> > I'm running IdP v2.3.2 with the attribute resolver configured to use a
> RelationalDatabase DataConnector.  The DataConnector may return multiple
> rows, in which case I expect attributes released to SPs to be encoded with
> multiple values.  (Although if an attribute has the *same* value in one or
> more rows, I don't care whether the IdP sends a single instance of the
> value, or repeated instances of the same value.)
> >
> > I have a situation where three rows are returned by my DataConnector,
> and two of the attributes - eduPersonScopedAffiliation and Entitlement -
> have different values in all three rows.  The IdP is encoding all three
> values of Entitlement in the attribute assertion which it makes, but only
> the first of the three eduPersonScopedAffiliation values.  There is
> nothing in the debug log to suggest that eduPersonScopedAffiliation values
> are being discarded.  Can anyone explain why two
> eduPersonScopedAffiliation values are being ignored?
> >
> > FWIW, I'm fairly sure that all attributes were being handled correctly
> in the past, so this behaviour *may* have been introduced by the move to
> v2.3.
> >
> > attribute-resolver.xml contains:
> >
> >    <resolver:AttributeDefinition id="eduPersonScopedAffiliation"
> xsi:type="Prescoped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> >        sourceAttributeID="ScopedAff">
> >        <resolver:Dependency ref="SQL" />
> >
> >        <resolver:AttributeEncoder xsi:type="SAML1ScopedString"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> >            name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
> scopeType="attribute" />
> >
> >        <resolver:AttributeEncoder xsi:type="SAML2ScopedString"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> >            name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
> friendlyName="eduPersonScopedAffiliation" />
> >    </resolver:AttributeDefinition>
> >
> >    <resolver:AttributeDefinition id="eduPersonEntitlement"
> xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> >        sourceAttributeID="Entitlement">
> >        <resolver:Dependency ref="SQL" />
> >
> >        <resolver:AttributeEncoder xsi:type="SAML1String"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> >            name="urn:mace:dir:attribute-def:eduPersonEntitlement" />
> >
> >        <resolver:AttributeEncoder xsi:type="SAML2String"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> >            name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7"
> friendlyName="eduPersonEntitlement" />
> >    </resolver:AttributeDefinition>
> >
> > I can provide an extract of idp-process.log (in DEBUG mode) if that
> would help.
> >
> > Thanks,
> > Phil.
> >
> > --
> > To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net
> >
> 
> 
> 
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net