LocalDynamic + MetadataFilters = possible bug?

[Mak, Steve]

I ran into an issue that I was wondering if anyone else has seen this.

TLDR: Sometimes our high volume services are not getting any attributes released when they should be. We created a static filter policy for the only high volume service we've seen the problem for and that has resolved the user complaints, but we're not happy leaving it there.



We originally thought maybe it was a problem without database during sync jobs. But we observed the sync process in close detail and found nothing that would explain a lack of attributes in the response.

So we started looking at the Metadata providers, and we think there may be a problem with using MetadataFilters the way we are.

Here's the config context.

We load services with LocalDynamicMetadataProvider and MetadataFilters, like this:

    <MetadataProvider id="default " xsi:type="LocalDynamicMetadataProvider" sourceDirectory="%{idp.home}/metadata/eg/default"
        failFastInitialization="false"
        refreshDelayFactor=".75"
        minCacheDuration="PT10M"
        maxCacheDuration="PT1H"
        maxIdleEntityData="PT1H"
        removeIdleEntityData="true"
        cleanupTaskInterval="PT30M">
        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:upenn.edu:blah:blah:blah:attribute:name">
                <saml:AttributeValue>urn:mace:upenn.edu:blah:blah:Default</saml:AttributeValue>
            </saml:Attribute>
            <ConditionRef>shibboleth.Conditions.TRUE</ConditionRef>
        </MetadataFilter>
    </MetadataProvider>

And have an attribute filter like this:

    <AttributeFilterPolicy id="default_services">
        <PolicyRequirementRule xsi:type="OR">
            <Rule xsi:type="EntityAttributeExactMatch" attributeName=" urn:mace:upenn.edu:blah:blah:blah:attribute:name" attributeValue=" urn:mace:upenn.edu:blah:blah:Default"/>
        </PolicyRequirementRule>
        <AttributeRule attributeID="eduPersonPrincipalName">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="eduPersonAffiliation">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="eduPersonScopedAffiliation">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="surname">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="givenName">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="displayName">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="email">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
    </AttributeFilterPolicy>

We stick our SP md files into the directories, and they get dynamically injected EntityAttributes on load, that control which attributes they get.


We use IdP v4.0.1 and never saw this problem in v3.4.6. I was wondering if the md localdynamic process is loading the md file and sending it to the IdP as loaded before the metadata filter finishes adding the dynamic value. I didn't think it was possible, and I'm sure it isn't. But I'm trying to understand the root cause.

Thanks,
Steve