LDAP uncaught exception

[Losen, Stephen C. (scl)]

Hi folks,

Below are our idp-process.log errors.  I suspect our problem is related to the definition of the attribute “qualtrics-division” which is type “Mapped” and it depends on two source attributes.  That always generates a WARN message for every shib login.  But I suspect that when this is combined with a user who has no LDAP record that the IDP generates the Uncaught exception (array index out of bounds).

I set up a test where user “bogus” logs in, who has no LDAP record.

2016-09-06 14:47:51,464 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:115] - Profile Action ValidateExternalAuthentication: External authentication succeeded for user: bogus
2016-09-06 14:47:51,474 - WARN [net.shibboleth.idp.session.AbstractIdPSession:217] - Unsupported address form (null)
2016-09-06 14:47:51,519 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'myLDAP' produced no value.
2016-09-06 14:47:51,523 - WARN [net.shibboleth.idp.attribute.resolver.PluginDependencySupport:144] - Plugin 'qualtrics-division' was defined with a sourceAttributeID 'isMemberOf', but the attribute definition 'eduPersonOrgUnitDN', specified as a <Dependency> will be used as well.
2016-09-06 14:47:51,592 - ERROR [net.shibboleth.idp.saml.profile:-2] - Uncaught runtime exception
java.lang.IndexOutOfBoundsException: Index: 0, Size: 0
    at java.util.ArrayList.rangeCheck(ArrayList.java:653)
2016-09-06 14:47:51,596 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: RuntimeException

When a user with no LDAP record logs in, the IDP displays the error page with this message:

A software error was encountered that prevents normal operation

java.lang.IndexOutOfBoundsEsception: Index: 0, size: 0

Please report this problem to your Help Desk or administrative staff.  It has also been logged for an administrator to review.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu<mailto:scl at virginia.edu>    434-924-0640

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Tuesday, September 06, 2016 10:41 AM
To: Shib Users
Subject: Re: LDAP uncaught exception

On Tue, Sep 6, 2016 at 7:49 AM, Losen, Stephen C. (scl) <scl at eservices.virginia.edu<mailto:scl at eservices.virginia.edu>> wrote:
We have some folks (alums) who can still authenticate with our SSO solution, but who do not have records in LDAP anymore.  We are running shib IDP v3.2.1 and are using RemoteUser to integrate with our SSO.  When a person with no LDAP record logs in to SSO, the subsequent IDP LDAP lookup fails and we get an "Uncaught exception" from the IDP.  Is this expected behavior?

No. What do you mean by "uncaught"? Are your users seeing a stacktrace at the IDP?

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160906/71be54d0/attachment.html>