Custom nameid getting released in version 2 but not version 3

[Cantor, Scott]

On 8/3/16 4:07 PM, shibboleth655 at lewenberg.com wrote:
> 
> However, in our Shibboleth version 3.2.1 environment (which uses
> essentially the same attribute-resolver and attribute-filter files),
> mailNameID does NOT get released if the suVisibEmail attribute is NOT
> set to "world".

You have me so twisted up trying to follow the example that I'm not
sure. I can say that it's all really confusing, so that probably
suggests it hit some sort of edge case.

> So, it appears that the attribute-filter suppressing an attribute that
> mailNameID uses suppresses mailNameID in version 3 but not version 2.

Filtering runs separately from resolving the attributes and happens
after. So that shouldn't make any difference in how the attributes end
up populated with data. The only thing that should matter is if the
attribute with the NameID encoder attached is released or not. Your
example doesn't indicate that either way. The dependencies shouldn't matter.

> We can work around this, but I wanted to know if the logic for attribute
> release changed between 2 and 3 to account for this?

There are numerous things that don't work right in V2 when you create
esoteric filter policies that act on other attributes. In V3, they all
do predictable things, but those things aren't always what people expect
them to be. I would have to see a more comprehensive summary of all the
pieces, and all the attributes released in each case, but in this case
the problem seems to be less to do with the filtering rule, but which
attribute it seems to be operating on. I think there's more to the
overall story than you posted.

I wouldn't be shocked if the weirdness didn't end up having something to
do with that bizarre double dependency in the attribute definition,
which is totally confusing me.

It's possible that it's not about filtering, but about the data it's
actually resolving for that attribute.

-- Scott