redundant attributes in IdPs SAML assertion

[Paul Hethmon]

On Jun 10, 2014, at 11:31 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

With MCB, Duo, and LDAP caching in my IdP 2.4.0, I am seeing double or
triple (if 2FA) copies of eduPersonAffiliation in the SAML assertion:

I don't really understand how that's possible unless they're tampering
with the resolution results given back to the regular profile handler. I
run the resolver myself inside a login handler, but that set of results
has nothing whatsoever to do with the result that comes back later. I
don't see how they can mix.

The MCB uses the Shib attribute resolver to get the IDMS attribute value, but those values it gets are never added to anything with the principal object, they stay within the MCB itself. That part of the code is pretty much a straight copy of Scott's code as well since that wheel was very round.

Perhaps some debug logging of the resolver caching might shed some light? If it grabs all the attributes every time the resolver is run, it would certainly see multiple values. Is it aware of the resolver being run multiple times as a possibility?

Paul

Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140611/f2237f36/attachment.html