Empty SubjectLocality element causing opensaml:: FatalProfileException

[Seppo.Smolander at tieto.com]

Hi

We are having problems with an identity provider sending
an empty SubjectLocality element in assertion.

This causes FatalProfileException in SP.

2016-08-22 15:28:56 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: SubjectLocality must have Address or DNSName.
2016-08-22 15:28:56 ERROR Shibboleth.Listener [4404] isapi_shib_extension: remoted message returned an error: SubjectLocality must have Address or DNSName.
2016-08-22 15:28:56 ERROR Shibboleth.ISAPI [4404] isapi_shib_extension: SubjectLocality must have Address or DNSName.

The Shibboleth is 2.6.0.0 running in Windows server 64bit with IIS 8.5.

Do you know of any workaround for this issue ? We do not really need
the SubjectLocality element but idP sends it empty and what it seems like
the element is checked against being ip address or dns name although it is empty
causing failure.

Setting of checkAddress="false" , consistentAddress="false" does not do the trick. :(

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" consistentAddress="false" handlerSSL="true" cookieProps="; path=/; secure; HttpOnly">

br.
Seppo


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160822/05e49e4f/attachment.html>