Question about attribute-map.xml

[Ken Weiss]

Scott,

Interesting. Instead of bouncing both Apache and shibd between tests, I
started testing after bouncing Apache, and then after bouncing shibd.
After restarting Apache, my protected resources were no longer protected.
Restarting shibd re-established the SP's control of the resources. So at
least on my system, it appears that if you restart Apache you must also
restart shibd. Is this normal behavior? If so, I'll modify my Apache
restart scripts to include a restart of shibd.

As for the AttributeDecoder thing... I swear to you, Scott, I tested this
more than a dozen times yesterday and the behavior was 100% consistent. I
wasn't re-typing anything, just commenting out the AttributeDecoder line,
and then putting it back in by removing the comment tags, with a restart
of Apache and shibd between each test. And today I ran the exact same
scenario and it works with or without the AttributeDecoder element,
exactly as you say it should. I believe I'll enjoy a morning cocktail and
stop thinking about this.

--Ken

------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612






On 7/16/13 6:33 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 7/16/13 5:42 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:
>>
>>I restarted Apache and shibd, cleared my cookies, and reauthenticated,
>>but
>>the mail attribute did not appear in my session. So I added
>>AttributeDecoder lines to attribute-map.xml, like this:
>
>That shouldn't be necessary, the string decoder is the default.
>
>>I looked at another Shibboleth SP that was set up over a year ago by my
>>predecessor, and the attribute-map.xml file only has the Attribute
>>statements, without the AttributeDecoder elements, but it works. I
>>searched for similar configurations on the Internet, and every single
>>example I found looked like the first case, with no AttributeDecoder
>>elements.
>
>They're equivalent.
>
>>I have this working, so it's not exactly a high priority, but I would
>>really like to better understand what's going on here. Why does my SP
>>require that I include the AttributeDecoder, when other SPs apparently
>>don't? Any thoughts?
>
>I'm pretty sure it doesn't, and you hit some sort of issue with the
>restart process, or possible you had a mistype initially and corrected it.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net