duplicate attributes when using metadataAttributePrefix

[Tamas Balogh]

Hi all,

I bumped into a strange thing when trying to extract attributes from the
IdP metadata using the SP attribute extractor using the docs from [1]. I
used chaining, and now the metadata extractor bit looks like to following:

<AttributeExtractor type="Chaining">
     <AttributeExtractor type="XML" validate="true"
			 reloadChanges="false" path="attribute-map.xml"/>
     <AttributeExtractor type="Metadata"
			 OrganizationDisplayName="orgDisplayName"/></AttributeExtractor>

According to the docs, you also have to set the 'metadataAttributePrefix'
for the attribute extraction to work, and so I did:
metadataAttributePrefix="Meta_" in the ApplicationDefaults.

I'm using apache with mod_shib enabled and 'ShibUseHeaders On' to transport
the extracted attributes. When dumping the headers in the application,
WITHOUT using the metadataAttributePrefix="Meta_" I see an expected set of
attributes, like:

cn = "Dummy Dummyson"
uid = "dummy"
mail = "dummy at google.com;dummy at my-domain.com"
givenName = "Dummy"
sn = "Dummyson"

But WITH metadataAttributePrefix="Meta_" (and the metadata extractor above)
set all these headers get a duplicate pair with and empty string as value,
like:

cn = "Dummy Dummyson"
Meta_cn = ""
uid = "dummy"
Meta_uid = ""
mail = "dummy at google.com;dummy at my-domain.com"
Meta_mail = ""
givenName = "Dummy"
Meta_givenName = ""
sn = "Dummyson"
Meta_sn = ""
orgDisplayName = ""
Meta_orgDisplayName = "TestIDP"

The 'Meta_orgDisplayName' gets set in the end, just as expected, so the
functionality is there. It's just strange that I see all these empty
headers. Not a big problem on the application side, since I can just filter
the empty values out, but it seems like the they shouldn't be there in the
first place.

Anyone else encountered similar any behavior?

P.S. I am aware that I should not be using ShibUseHeaders at all because of
the spoofing issue [2], but my current application only looks at headers.
We're already planning to patch it up to use ShibUseEnvironment instead.
When using ShibUseEnvironment the issue described above is not longer
there, so that's all good ;)

Cheers,
Tom

Software:

CentOS 7
shibboleth-2.5.5-3.1.x86_64
httpd-2.4.6-40.el7.centos.x86_64

[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor#NativeSPAttributeExtractor-MetadataAttributeExtractor%28Version2.5andAbove%29


[2]
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking#NativeSPSpoofChecking-Apache