Affiliation scope origin and configuration: unexpectedly removed value

Thomas Blanchard tblanchard at linkedin.com
Tue Jun 26 10:37:02 EDT 2018 

Hello Shib folks,

I have an issue with affiliation attribute extraction. 2 similar setup (entity ID & cert are different) yields different attribute scoping: in only one of the 2 setup the attribute we rely on for logging in a person is removed by the AttributeFilter.

# Context:
I manage an SP, I have a customer with issues connecting their IdP with our SP.
The customer has 2 IdP, one for test, one for prod, which are both registered with my SP.
The metadata for the IdP is the same with exception of the URL & entity ID.

When login with the test IdP, my SP retrieves 2 values from the affiliation attribute.
When login with the prod IdP, my SP drops one of the 2 values (of course the one we need) from the affiliation attribute.
In the Shib Session page, the prod IdP session has the following affiliation:
affiliation: mainaffiliation at example.edu.ex

And the test IdP:
affiliation: mainaffiliation at example.edu.ex;secondaryaffiliation at other-example.net

My question is: Where is this filtering configured to create this problem ? What additional steps should me or my customer do to figure out this issue ?

I've reviewed my attribute-policy.xml, but since the same attribute (exact same value) passes the filtering in one of the 2 setup, I doubt that this is the issue.
I'm wondering if this is linked to the shibmd:Scope extension regex, but I did some testing with different values (updating IdP MD with static values, and allow all regex) without solving this problem.

We've tested in 2 shibboleth SP setup (one running shib 2.3 and one 2.5 and yes, we're upgrading).

Below is some info regarding the Session, logs and metadata info.

# IdP Metadata excerpt (same for both except for signing certs & entity ID)
    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
      <Extensions>
        <shibmd:Scope regexp="true">^(.*\.)?(example\.edu\.ex|other-example\.net)$</shibmd:Scope>
[...]
      </Extensions>
[...]
    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
      <Extensions>
        <shibmd:Scope regexp="true">^(.*\.)?(example\.edu\.ex|other-example\.net)$</shibmd:Scope>
      </Extensions>
[...]

# Prod SP logs
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting issuer from SAML 2.0 assertion
DEBUG Shibboleth.SSO.SAML2 [29639]: SSO profile processing completed successfully
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting pushed attributes...
DEBUG Shibboleth.AttributeDecoder.String [29639]: decoding SimpleAttribute (uid) from SAML 2 Attribute (urn:oid:0.9.2342.19200300.100.1.1) with 1 value(s)
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (affiliation) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.9) with 2 value(s)
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)
DEBUG Shibboleth.AttributeFilter [29639]: filtering 3 attribute(s) from (https://idp1.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (uid) from (https://idp1.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (affiliation) from (https://idp1.example.edu.ex/idp/shibboleth)
WARN Shibboleth.AttributeFilter [29639]: removed value at position (1) of attribute (affiliation) from (https://idp1.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (eppn) from (https://idp1.example.edu.ex/idp/shibboleth)

# Test SP Logs
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting issuer from SAML 2.0 assertion
DEBUG Shibboleth.SSO.SAML2 [29639]: SSO profile processing completed successfully
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting pushed attributes...
DEBUG Shibboleth.AttributeDecoder.String [29639]: decoding SimpleAttribute (uid) from SAML 2 Attribute (urn:oid:0.9.2342.19200300.100.1.1) with 1 value(s)
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (affiliation) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.9) with 2 value(s)
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)
DEBUG Shibboleth.AttributeFilter [29639]: filtering 3 attribute(s) from (https://idptest.ad.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (uid) from (https://idptest.ad.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (affiliation) from (https://idptest.ad.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (eppn) from (https://idptest.ad.example.edu.ex/idp/shibboleth)
DEBUG Shibboleth.SSO.SAML2 [29639]: resolving attributes...



# Prod Session
Miscellaneous
Session Expiration (barring inactivity): 479 minute(s)
Client Address: (obfuscated)
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://idp1.example.edu.ex/idp/shibboleth
Authentication Time: 2018-06-21T19:29:51.467Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes
affiliation: mainaffiliation at example.edu.ex
eppn: someuser at example.edu.ex
uid: someuser


# Test Session
Miscellaneous
Session Expiration (barring inactivity): 479 minute(s)
Client Address: (obfuscated)
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://idptest.ad.example.edu.ex/idp/shibboleth
Authentication Time: 2018-06-21T19:31:05.557Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes
affiliation: mainaffiliation at example.edu.ex;secondaryaffiliation at other-example.net
eppn: someuser at example.edu.ex
uid: someuser


# Assertion decrypted on the SP for Prod IdP
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="(obfuscated)" IssueInstant="2018-06-07T17:59:21.724Z" Version="2.0">
        <saml2:Issuer>https://idp1.example.edu.ex/idp/shibboleth</saml2:Issuer>
[...]
        <saml2:AttributeStatement>
                <saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>someuser</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>mainaffiliation at example.edu.ex</saml2:AttributeValue>
                        <saml2:AttributeValue>secondaryaffiliation at other-example.net</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>someuser at example.edu.ex</saml2:AttributeValue>
                </saml2:Attribute>
        </saml2:AttributeStatement>
</saml2:Assertion>

# Assertion decrypted on the SP for test IdP
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="(obfuscated)" IssueInstant="2018-06-07T19:13:46.523Z" Version="2.0">
        <saml2:Issuer>https://idptest.ad.example.edu.ex/idp/shibboleth</saml2:Issuer>
[...]
        <saml2:AttributeStatement>
                <saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>someuser</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>mainaffiliation at example.edu.ex</saml2:AttributeValue>
                        <saml2:AttributeValue>secondaryaffiliation at other-example.net</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>someuser at example.edu.ex</saml2:AttributeValue>
                </saml2:Attribute>
        </saml2:AttributeStatement>
</saml2:Assertion>

--
Thomas Blanchard
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180626/e9fa09e4/attachment.html>

More information about the users mailing list