Script Attributes definition

[Bin Han]

Hello All:

Currently we are running into a "thread safe" bug by sending scripted attributes, if anyone has an idea:

One of our application is running on IDP V2 (yes, we do plan to move to V3), the attributes have to be gathered across departments, so about 8 attributes are configed as scripted attributes in attribute-resolver.xml, assign their value by calling a web service built by another department, the script parses the returned XML file. However in V2, each script can only assign value to one attribute (please correct me if I am wrong here), we have to reuse the script 8 times in each script attribute definition, call the web service 8 times, and process the returned XML 8 times. This login process can take around 1 second or 2.

So recently we found a bug, which is when multiple users login at the same time, the script attributes will be assigned randomly, for example, after logging in, user1's netname with user2's barcode...

Attached is a copy of the script code, so I am wondering, when Shibboleth process login request, is the whole session thread safe? Or is there any config I am missing, or something wrong with the code?

Appreciate,

<resolver:AttributeDefinition  id="barcode" xmlns="urn:mace:shibboleth:2.0:resolver:ad" xsi:type="Script">
		<resolver:Dependency ref="forScript"/>
		<resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
				name="urn:mace:dir:attribute-def:barcode" />
		<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
				name="urn:oid:1.3.6.1.4.1.25178.1.2.9" friendlyName="barcode" />
		<Script>
			<![CDATA[
				var URL = Java.type('java.net.URL'); 
                var URLConnection = Java.type('java.net.URLConnection'); 
                var BufferedReader = Java.type('java.io.BufferedReader');  
                var InputStreamReader = Java.type('java.io.InputStreamReader');  
                var documentBuilderFactory = Java.type('javax.xml.parsers.DocumentBuilderFactory');  
                var documentBuilder = Java.type('javax.xml.parsers.DocumentBuilder');
                var stringBuilder = Java.type('java.lang.StringBuilder');  
                var DOMdocument = Java.type('org.w3c.dom.Document');
                var DOMnodeList = Java.type('org.w3c.dom.NodeList');
                var DOMnode = Java.type('org.w3c.dom.Node');
                var DOMelement = Java.type('org.w3c.dom.Element');
                var ByteArrayInputStream = Java.type('java.io.ByteArrayInputStream');
            
            
                var strUrl = "http://webservice/netname="+requestContext.principalName;
                service = new URL(strUrl);
                yc = service.openConnection();
                raw = new BufferedReader( new InputStreamReader( yc.getInputStream()));
                
                var xmlDoc = new stringBuilder;
                
                var cont = 0;
                while ((inputLine = raw.readLine()) != null) 
                        xmlDoc.append(inputLine);
                
                raw.close();
                
                input =  new ByteArrayInputStream( xmlDoc.toString().getBytes("UTF-8"));
                
                dbFactory = documentBuilderFactory.newInstance();
                dBuilder = dbFactory.newDocumentBuilder();
                doc = dBuilder.parse(input);
                doc.getDocumentElement().normalize();
                nList = doc.getElementsByTagName("error");
				if (null == barcode) {
					var BasicAttribute = Java.type("edu.internet2.middleware.shibboleth.common.attribute.provider.BasicAttribute");
					barcode = new BasicAttribute("barcode");
				}
				
				if(nList.getLength() == 0 ){
                    barcodestr = doc.getElementsByTagName("barcode").item(0).getTextContent();
					
					barcode.getValues().clear();
					barcode.getValues().add(barcodestr);
                }else{
					barcode.getValues().clear();
					barcode.getValues().add("ERROR");
                }
			]]>
		</Script>
	</resolver:AttributeDefinition >

Bin

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: November-02-16 12:00 PM
To: users at shibboleth.net
Subject: users Digest, Vol 65, Issue 6

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."


Today's Topics:

   1. Re: Sending AuthRequest without ACS (Rainer Hoerbe)
   2. RE: ApplicationOverride results in "Unable to locate an
      encrypted key" (Cantor, Scott)


----------------------------------------------------------------------

Message: 1
Date: Wed, 2 Nov 2016 13:38:29 +0100
From: Rainer Hoerbe <rainer at hoerbe.at>
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending AuthRequest without ACS
Message-ID: <C81C4054-3E66-46A5-9165-378D51BDB663 at hoerbe.at>
Content-Type: text/plain; charset=us-ascii


> Am 01.11.2016 um 19:17 schrieb Cantor, Scott <cantor.2 at osu.edu>:
> 
>> Yes, I understand that this is not feasible when sending responses 
>> with attributes etc. But is it illegal from the spec?
> 
> It's undefined in the *profile*. The IdP preconfigures the allowable bindings it supports in various directions. If you really wanted to get it to respond, yes, you could.

Thanks for the clarification. I just dropped the test case :-)

- Rainer

------------------------------

Message: 2
Date: Wed, 2 Nov 2016 13:27:50 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: ApplicationOverride results in "Unable to locate an
	encrypted key"
Message-ID:
	<9846A6064BD102419D06814DD0D78DE112A7FF77 at CIO-TNC-D2MBX02.osuad.osu.edu>
	
Content-Type: text/plain; charset="utf-8"

Basic advice:

Never use different keys with overrides, that doesn't really serve any purpose.

The error is because of the key name information the IdP is probably embedding in the message.

There are no "correct" names in an SP certificate used for authentication, signing, or encryption. Only the key matters. Screwing around with the names will create errors where none would have existed.

-- Scott
 

------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 65, Issue 6
************************************