persistent-id decode errors

[Ian Young]

On 7 Aug 2013, at 17:45, Andy Bennett <andyjpb at knodium.com> wrote:

> persistent-id appears twice with one value each time. In all the other
> sessions (which succeed) it only appears once (with one value).

I'd have to see more details, e.g., the full attribute assertion from your logs, but the IdP is probably sending you the same thing in two different encodings.

> It looks like the two persistent-ids are being concatenated together,
> separated by ";" and then passed to our app.

Yes.

> Is this a decoding error on our part or an issue on the IDP side?

Postel's law probably applies here.  The IdP is probably not doing what we'd ideally like it to be doing, but your application would be best served by being tolerant of multiple identical values.

> If it's an error on our part, is it a Shibboleth SP configuration error,
> a Shibboleth SP bug, or an issue with our app (which takes
> persistent-id, splits it on '!' and expects three parts).

The easiest place to fix this is probably in the app.

As I say, really getting a handle on the details of this would mean going through your logs and maybe even talking to the IdP deployer about their configuration.  The UKf helpdesk can help you if you need to do that.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130807/2179e751/attachment-0001.bin