redundant attributes in IdPs SAML assertion

[David Bantz]

The replication of attribute assertions in the SAML assertion is robust and reproducible for those directory attributes manipulated to produce SAML attributes using the same name  in an environment including local directory results caching and the repeated invocation of attribute resolver triggered by MCB.  

The work-around we’ve implemented is to 
1. not encode the directory attribute (e.g., not encode eduPersonAffiliation), instead 
2. defining and manipulating a new local/internal attribute with its own id (e.g., uakeduPersonAffiliation) that has a dependency on the attribute with the canonical name and 
3. encoding that manipulated local attribute (uakeduPersonAffiliation) as the canonical attribute (e.g., as urn:oid:1.3.6.1.4.1.5923.1.1.1.1 for eduPersonAffiliation).  
4. Then of course, the attribute filter has to release the attribute with the new internal id (e.g., uakeduPersonAffiliation).

Not elegant, but almost easier to do than to describe, and it has resolved the issue.

David Bantz
UA IAM


On Tue, 10 Jun 2014, at 18:50 , David Bantz <dabantz at Alaska.edu> wrote:

> With MCB, Duo, and LDAP caching in my IdP 2.4.0, I am seeing double or triple (if 2FA) copies of eduPersonAffiliation in the SAML assertion:
> 
>       <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Member</saml2:AttributeValue>
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Staff</saml2:AttributeValue>
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee</saml2:AttributeValue>
>       </saml2:Attribute>
>       <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Member</saml2:AttributeValue>
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Staff</saml2:AttributeValue>
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee</saml2:AttributeValue>
>       </saml2:Attribute>
>       <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Member</saml2:AttributeValue>
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Staff</saml2:AttributeValue>
>          <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee</saml2:AttributeValue>
>       </saml2:Attribute>
...

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140624/dd38ea8d/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140624/dd38ea8d/attachment.bin