redundant attributes in IdPs SAML assertion

[David Bantz]

With MCB, Duo, and LDAP caching in my IdP 2.4.0, I am seeing double or triple (if 2FA) copies of eduPersonAffiliation in the SAML assertion:

      <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Member</saml2:AttributeValue>
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Staff</saml2:AttributeValue>
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Member</saml2:AttributeValue>
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Staff</saml2:AttributeValue>
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Member</saml2:AttributeValue>
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Staff</saml2:AttributeValue>
         <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee</saml2:AttributeValue>
      </saml2:Attribute>


No other attributes are similarly triplicated.  I supposed some poor behavior of my script that adds value of Member or Affiliate since those aren’t in the LDAP (below), but when I commented out the cache statement in the data connector,
normal behavior resumed.  I’d like to enable caching since the MCB + Duo combination runs the attribute resolver 2 or 3 times, but don’t see how to avoid the redundant ePA assertions.

...
<!--   <ResultCache elementTimeToLive="PT1H" maximumCachedElements="100"/> -->
    </resolver:DataConnector>

….
<!-- eduPersonAffiliation from LDAP values with Member or Affiliated added as needed -->
<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
               id="eduPersonAffiliation"
               sourceAttributeID="eduPersonAffiliation">

    <resolver:Dependency ref="myLDAP" />

    <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                       name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
    <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                       name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                               friendlyName="eduPersonAffiliation" />

    <Script><![CDATA[
        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
        importPackage(Packages.org.slf4j);
        logger = LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.scriptTest");
	logger.debug(" ePA script; starting ePA values: " + eduPersonAffiliation.getValues()); 

//  Manipulate values only if eduPersonAffiliation directory value(s) exist
if (typeof eduPersonAffiliation != "undefined" && eduPersonAffiliation != null) {
           // Add attribute value "Member" if entailed by other affiliation
                if (eduPersonAffiliation.getValues().contains("Student") 
                 || eduPersonAffiliation.getValues().contains("Employee")
                 || eduPersonAffiliation.getValues().contains("Staff")
                 || eduPersonAffiliation.getValues().contains("Faculty")) 
                { 
                if (!(eduPersonAffiliation.getValues().contains("Member"))) {eduPersonAffiliation.getValues().add("Member");}
		logger.debug(" ePA script: include Member; ePA  values: " + eduPersonAffiliation.getValues()); 
                }
}
// Otherwise, create if null
            else
		if (eduPersonAffiliation == null) {eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");}
		logger.debug(" ePA script non-S/E/S/F; ePA values: " + eduPersonAffiliation.getValues());         

//  Add Affiliate if neither Member nor Affiliate 
               if ( !(eduPersonAffiliation.getValues().contains("Affiliate")) && !(eduPersonAffiliation.getValues().contains("Member")) ) 
                      {eduPersonAffiliation.getValues().add("Affiliate");
			logger.debug(" ePA script add Affiliate; ePA values: " + eduPersonAffiliation.getValues());
                      }
    ]]></Script>
</resolver:AttributeDefinition>

David Bantz
U Alaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140610/6070d044/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140610/6070d044/attachment-0001.bin