Memcache extension and a 256 character TargetedID

[Sonny Garcia]

I've compiled a copy of shibboleth 2.4.3-2.2 enabling the memcache extension and, so far, this particular build works fine except when a client IdP passes a long TargetedID in the subject of the assertion as opposed to using a SAML attribute; shibboleth documentation indicates that this is the "recommended" approach.

<b>decrypted Assertion segment from logs</b>

<saml2:Subject>
  <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
  NameQualifier="urn:mace:incommon:src.edu"
  SPNameQualifier="https://dest.com/shibboleth-sp">
V2QGKF4ARARGIQKFFTOI7AZXKRQOPNMBEVF6TQZM2FQR5SLKY3VCSSXL4HU6CBWKCVW4TTCP33BBCRMFBYMFKA3M6COTBSW326MOP5IJCYCJW6RATFHHTDHFQKM3HKIGYISA3VSOE5EHJY6GJQ5ELRCOP4BPZ6ALYPS2GMMSLU7HP6JQYBGDKRS2JUCY55UN36KA63HWWK3ZFTOPKUAOUNKDE6532QNRH6LGKTP57VBEYV6SKBWTNDY2FDAGH7ME
  </saml2:NameID>
...
</sam2:Subject>

In this instance, the SessionCache errors out when attempting to insert data using this NameID; please note that the value is 256 chars in length.

<b>cache error from logs</b>

2012-02-20 17:28:16 DEBUG Shibboleth.SessionCache [2]: creating new session
2012-02-20 17:28:16 DEBUG XMLTooling.MemcacheBase [2]: readString ctx: Logout - key: V2QGKF4ARARGIQKFFTOI7AZXKRQOPNMBEVF6TQZM2FQR5SLKY3VCSSXL4HU6CBWKCVW4TTCP33BBCRMFBYMFKA3M6COTBSW326MOP5IJCYCJW6RATFHHTDHFQKM3HKIGYISA3VSOE5EHJY6GJQ5ELRCOP4BPZ6ALYPS2GMMSLU7HP6JQYBGDKRS2JUCY55UN36KA63HWWK3ZFTOPKUAOUNKDE6532QNRH6LGKTP57VBEYV6SKBWTNDY2FDAGH7ME
2012-02-20 17:28:16 ERROR XMLTooling.MemcacheBase [2]: Memcache::getMemcache() Problems: CLIENT ERROR

I attempted to trim the id length by using an <AttributeDecoder> with a hashAlg specified, but that did not remove the fatal error.
I believe that this failed because, once again, the NameID was passed in the subject line and <i>NOT</i> as an attribute.

<b>inside attribute-map.xml</b>

<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" id="transient-id">
  <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="false" hashAlg="SHA1"/>
</Attribute>

Is there another means of addressing this issue?


-- S. R. Garcia