SP issue: Shib-Identity-Provider not set for some IdPs

[Cantor, Scott]

On 3/31/12 8:09 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>* Sara Hopkins <sara.hopkins at ed.ac.uk> [2012-03-31 01:22]:
>> I'm trying to help a client just now whose SP (Shibboleth 2.0 or 2.1 I
>> believe) is seeing that the Shib-Identity-Provider variable is set upon
>> authentication for some IdPs but not for others.
>
>Until or in 2.1 there was a bug where Shib-Identity-Provider
>sometimes was not set. I can't recall the specifics but either way
>they shouldn't be running 2.1 anyway.

Yes, I believe it related to encryption and signing in a particular
combination. The security wasn't compromised, but the information being
pulled from the response wasn't handled properly.

Technically it's possible when creating a session to not have an issuer,
that's why the code doesn't crash. But it's not consistent with any
security model supported by the built-in code, so that's an unintentional
situation right now.

-- Scott