Custom nameid getting released in version 2 but not version 3

[shibboleth655 at lewenberg.com]

On 8/3/2016 1:46 PM, Cantor, Scott wrote:
> On 8/3/16 4:07 PM, shibboleth655 at lewenberg.com wrote:
>>
>> However, in our Shibboleth version 3.2.1 environment (which uses
>> essentially the same attribute-resolver and attribute-filter files),
>> mailNameID does NOT get released if the suVisibEmail attribute is NOT
>> set to "world".
>
> You have me so twisted up trying to follow the example that I'm not
> sure. I can say that it's all really confusing, so that probably
> suggests it hit some sort of edge case.
>
>> So, it appears that the attribute-filter suppressing an attribute that
>> mailNameID uses suppresses mailNameID in version 3 but not version 2.
>
> Filtering runs separately from resolving the attributes and happens
> after. So that shouldn't make any difference in how the attributes end
> up populated with data. The only thing that should matter is if the
> attribute with the NameID encoder attached is released or not. Your
> example doesn't indicate that either way. The dependencies shouldn't matter.
>
>> We can work around this, but I wanted to know if the logic for attribute
>> release changed between 2 and 3 to account for this?
>
> There are numerous things that don't work right in V2 when you create
> esoteric filter policies that act on other attributes. In V3, they all
> do predictable things, but those things aren't always what people expect
> them to be. I would have to see a more comprehensive summary of all the
> pieces, and all the attributes released in each case, but in this case
> the problem seems to be less to do with the filtering rule, but which
> attribute it seems to be operating on. I think there's more to the
> overall story than you posted.
>
> I wouldn't be shocked if the weirdness didn't end up having something to
> do with that bizarre double dependency in the attribute definition,
> which is totally confusing me.
>
> It's possible that it's not about filtering, but about the data it's
> actually resolving for that attribute.


Let me try and clarify.

We are using Shibboleth 3.2.1 with nameid-formats using the legacy 
generators. We define an attribute "mailNameID" with a nameid encoder in 
attribute-resolver.xml that depends on another attribute (in this case 
"mail"). In attribute-filter.xml we explicitly release "mailNameID" but 
we do _not_ release the "mail" attribute.

When we do this, the "mailNameID" does not get released. If we 
explicitly release the "mail" attribute along with "mailNameID", then 
"mailNameID" _does_ get released.












>
> -- Scott
>