Specific attributes for principal null were not requested

[Cantor, Scott]

On 9/12/12 5:54 PM, "It Meme" <it.meme01 at gmail.com> wrote:
>
> I need to justify any upgrades to management and if to stick with a
>software platform - part of the process is understand what could
>trigger the bug and to add financial figure to upgrade, staying with
>version, or ditching the software for alternative.

You're on an unsupported version of the software. That's all I can tell
you. I think 2.2 might even predate critical security fixes, but I don't
recall.

>As some of authentications are impacted, any clues on what this could be?

No. I only support the IdP with answers based on my deployment. If I've
never seen the bug, I don't have any special insight into what it is other
than my knowledge of the authentication layer from writing my own plugins.
I wrote the SP, I didn't write any of the IdP. I also don't use JAAS
principal objects in any special way and I know that there have been bugs
and issues around things that I just don't use like custom principal
objects.

>Could it be related to session timeout settings in the load balancer,
>unsupported browser etc? Any ideas on where to look will be of great
>help and good karma :)

If you have sticky sessions covering the duration of the login process
from request to response, then it has nothing to do with your load
balancer. It has nothing to do with the client. There is no way to have a
null identity and not have a bug. It's a bug by definition. Even if the
load balancer was broken, that doesn't mean the IdP is supposed to pass
control on without an identity.

Since 2.2 is out of date and there have been bugs in the authentication
engine, and nobody else is reporting this bug of late, my conclusion is
that it's probably been fixed.

-- Scott