IdP attribute filter strategy

[Cantor, Scott]

On 6/8/15, 3:08 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 6/8/15, 3:02 PM, "users on behalf of Jeffrey Crawford" <users-bounces at shibboleth.net on behalf of jeffreyc at ucsc.edu> wrote:
>
>>For example the following, only adds the "first" entry "attr1" to the metadata. If you wanted filtering done on an attribute by attribute basis then the following doesn't work:
>
>Then it's a bug, but I don't know what doesn't work actually means in this context. There's of course no way to observe it working other than by exploiting it. It isn't visible anywhere. It could well be the bug is in the other exploiting end, but we'd have to investigate.

Looking at the filter code it's also pretty dead simple, so it's much more plausible the problem lies in whatever is supposed to honor the extension than the filter that's creating it. Probably some lazy code that's not walking the whole list once it finds a matching Attribute to accumulate more values, so the filter's "shortcut" is just exposing that bug.

-- Scott