SubjectDataConnector questions and NPE

Nate Klingenstein ndk at signet.id
Sun Oct 11 06:19:34 UTC 2020 

All,

I'm trying to build the simplest proxy configuration that I can based on the SubjectDataConnector.  Everything starts up fine and goes fine until things get passed into canonicalization.  First, the config:

<AttributeResolver
        xmlns="urn:mace:shibboleth:2.0:resolver"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">


    <!-- ========================================== -->
    <!--      Attribute Definitions                 -->
    <!-- ========================================== -->

    <AttributeDefinition id="uid" xsi:type="Simple">
            <InputDataConnector ref="passThroughAttributes" attributeNames="uid" />
    </AttributeDefinition>

    <AttributeDefinition id="mail" xsi:type="Simple">
            <InputDataConnector ref="passThroughAttributes" attributeNames="mail" />
    </AttributeDefinition>
    <!-- ========================================== -->
    <!--      Data Connectors                       -->
    <!-- ========================================== -->

    <DataConnector id="passThroughAttributes" xsi:type="Subject" forCanonicalization="true" relyingParties="https://samltest.id/saml/idp" exportAttributes="mail uid" />
</AttributeResolver>



<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
        xmlns="urn:mace:shibboleth:2.0:afp"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">

            <AttributeFilterPolicy id="saml-proxy-pass-through">
                                        <PolicyRequirementRule xsi:type="Issuer" value="https://samltest.id/saml/idp" />
                                        <AttributeRule attributeID="uid" permitAny="true" />
                                        <AttributeRule attributeID="mail" permitAny="true" />
            </AttributeFilterPolicy>

</AttributeFilterPolicyGroup>


    <util:list id="shibboleth.c14n.attribute.AttributesToResolve">
            <value>uid</value>
            <value>mail</value>
    </util:list>

    <!--
    A list of attributes to search for a value to produce as the normalized subject name.
    This will normally be something you resolve above.
    -->
    <util:list id="shibboleth.c14n.attribute.AttributeSourceIds">
            <value>uid</value>
            <value>mail</value>
    </util:list>

^ (I know mail shouldn't be necessary here, but I was fiddling)


Second, the logs and NPE:

2020-10-11 05:54:03,965 - 67.164.181.150 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:414] - Profile Action ValidateSAMLAuthentication: Incoming SAML Attributes mapped to attribute IDs: [eduPersonEntitlement, telephoneNumber, mail, displayName, givenName, uid, samlSubjectID, sn]
2020-10-11 05:54:03,974 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:112] - Attribute filtering engine 'ShibbolethAttributeFilter'  Beginning process of filtering the following 8 attributes: [samlSubjectID, sn, telephoneNumber, displayName, uid, eduPersonEntitlement, mail, givenName]

2020-10-11 05:54:03,976 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeRule:183] - Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_c49216f621084fcf4b1def468a53a787'  Filtering values for attribute 'uid' which currently contains 1 values
2020-10-11 05:54:03,976 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeRule:192] - Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_c49216f621084fcf4b1def468a53a787'  Filter has permitted the release of 1 values for attribute 'uid'
2020-10-11 05:54:03,977 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeRule:183] - Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_ea683ca8f81a38b55c0858818b770ba6'  Filtering values for attribute 'mail' which currently contains 1 values
2020-10-11 05:54:03,977 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeRule:192] - Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_ea683ca8f81a38b55c0858818b770ba6'  Filter has permitted the release of 1 values for attribute 'mail'

2020-10-11 05:54:03,978 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:178] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'uid' remained after filtering
2020-10-11 05:54:03,979 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:178] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'mail' remained after filtering

2020-10-11 05:54:04,039 - 67.164.181.150 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:75] - Profile Action PopulateSubjectCanonicalizationContext: Installing 3 canonicalization flows into SubjectCanonicalizationContext
2020-10-11 05:54:04,042 - 67.164.181.150 - INFO [Shibboleth-Audit.SSO:282] - 67.164.181.150||2020-10-11T05:54:04.041970Z||https://samltest.id/saml/idp|_db379e4ad6bf057a864fe1e948e522b2|password|2020-10-11T05:54:00.284Z|mail,uid|AAdzZWNyZXQxcQg/hR+214RBbf6bMWWDvK404TheN1T88fORSPiHuZ3/8wt8f48PpxPBiQdalfEfsBYpMeL1ZwfhqV+/OM1DqabcdbfCZvlUIoBHYxoMG9D7/dVOhxzMv24pSBEpMm4+cInG|transient||false||POST|POST||Success|||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36

2020-10-11 05:54:04,102 - 67.164.181.150 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/attribute for applicability...
2020-10-11 05:54:04,102 - 67.164.181.150 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/attribute
2020-10-11 05:54:04,157 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:222] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution
2020-10-11 05:54:04,157 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:431] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'passThroughAttributes'
2020-10-11 05:54:04,157 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'passThroughAttributes'
2020-10-11 05:54:04,158 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:392] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector passThroughAttributes
2020-10-11 05:54:04,158 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:246] - Resolver plugin 'passThroughAttributes': activation criteria not met, nothing to do
2020-10-11 05:54:04,158 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:412] - Attribute Resolver 'ShibbolethAttributeResolver': Data connector 'passThroughAttributes' produced no attributes
2020-10-11 05:54:04,160 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:250] - Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve the following attribute definitions [uid, mail]
2020-10-11 05:54:04,161 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:431] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'uid'
2020-10-11 05:54:04,161 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'uid'
2020-10-11 05:54:04,162 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:137] - Attribute Definition 'uid': produced an attribute with no values

2020-10-11 05:54:04,163 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:335] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'uid' produced an attribute with 0 values
2020-10-11 05:54:04,164 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:431] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'mail'
2020-10-11 05:54:04,164 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'mail'
2020-10-11 05:54:04,164 - 67.164.181.150 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:137] - Attribute Definition 'mail': produced an attribute with no values

2020-10-11 05:54:04,174 - 67.164.181.150 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
java.lang.NullPointerException: null
        at net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl.collectExportingDataConnectors(AttributeResolverImpl.java:542)
2020-10-11 05:54:04,179 - 67.164.181.150 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
2020-10-11 05:54:04,180 - 67.164.181.150 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2020-10-11 05:54:04,180 - 67.164.181.150 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:312] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2020-10-11 05:54:04,180 - 67.164.181.150 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed

This, on the other hand, worked fine for uid:

            <AttributeFilterPolicy id="saml-proxy-pass-through">
                                        <PolicyRequirementRule xsi:type="Issuer" value="https://samltest.id/saml/idp" />
                                        <AttributeRule attributeID="uid" permitAny="true" />
                                        <AttributeRule attributeID="mail" permitAny="true" />
            </AttributeFilterPolicy>

    <AttributeDefinition xsi:type="SubjectDerivedAttribute"
            forCanonicalization="true"
            principalAttributeName="uid"
            id="proxied-uid"
            />

It would seem like I'm missing an activationCondition for the SubjectDataConnector, but it also seems like relyingParties should work and is mutually exclusive with a reference to an activationConditionRef.

https://wiki.shibboleth.net/confluence/display/IDP4/SubjectDataConnector

What am I doing wrong here?

Thanks in advance, and sorry for the long message,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

More information about the users mailing list