persistent-id decode errors

[Andy Bennett]

Hi,

We have a Shibboleth SP that receives messages from IDPs in the UK
Federation and we have recently seen a failure on the first attempt at a
login from an IDP that has not contacted us before. Logins work with the
other IDPs in the Federation that have contacted us in the past.

In our app (via FastCGI) we are receiving a bogus value in
persistent-id. It seems to have 5 components separated by '!' as opposed
to the usual 3. However, we are receiving the correct thing in
REMOTE_USER which is set to choose from eppn, persistent-id or targeted-id.

The value is along these lines:

-----
https://<their-idp>/metadata!https://www.knodium.com/Shibboleth.sso/Metadata!<base-64-as-per-local-part-of-targeted-id>;https://<their-idp>/metadata!https://www.knodium.com/Shibboleth.sso/Metadata!<base-64-as-per-local-part-of-targeted-id>")
-----

...so

<X> ! <Y> ! <Z> ; <X> ! <Y> ! <Z>




Here are the entries relating to persistent-id as they appear in
attribute-map.xml:

-----
<!-- Second, an alternate decoder that will decode the incorrect form
into the newer form. -->
    <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID"
id="persistent-id">
        <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
    </Attribute>

    <!-- Third, the new version (note the OID-style name): -->
    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
    </Attribute>

    <!-- Fourth, the SAML 2.0 NameID Format: -->
    <Attribute
name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
id="persistent-id">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
    </Attribute>
-----


In shibboleth2.xml we have:
-----
REMOTE_USER="eppn persistent-id targeted-id"
-----



In the transaction.log for the relevant session we have:

-----
Cached the following attributes with session (ID: XXX) for
(applicationId: default) {
   persistent-id (1 values)
   affiliation (1 values)
   targeted-id (1 values)
   persistent-id (1 values)
   entitlement (1 values)
}
-----

persistent-id appears twice with one value each time. In all the other
sessions (which succeed) it only appears once (with one value).


We are running 2.4.3 on Debian stable and are unable to upgrade to a
newer series as there are a lot of dependencies (such as the XML
tooling) which can't build them. However, We are able to patch this
version and recompile.




It looks like the two persistent-ids are being concatenated together,
separated by ";" and then passed to our app. Is this a decoding error on
our part or an issue on the IDP side?

If it's an error on our part, is it a Shibboleth SP configuration error,
a Shibboleth SP bug, or an issue with our app (which takes
persistent-id, splits it on '!' and expects three parts).



Many thanks for your time.






Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/