LocalDynamic + MetadataFilters = possible bug?

[Mak, Steve]

I agree that all of my LocalDynamic filters are also working fine, 99.99% of the time. This single service out of thousands has been the lone problem.


Regarding checking my logs, the IdP has no errors during runtime or startup. We inspected logs all around the time we would see the error and found nothing. The sp metadata file in question has been unchanged since April 2019.

The reason it's odd is that the errors were so infrequent that we had to setup an alert to watch for audit log lines that were missing attributes for this specific SP, and it was happening for about 30 minutes (sp metadata cache life, also resolved attributes cache life) sporadically every 3-4 weeks over 3-4 months, when nothing else about the config changed.

We used aacli for the specific users reporting problems to test during the 30 min error window to confirm that the IdP did resolve attributes for that user correctly in the error window. We originally believed it might be related to our database swapping in new synced data. Everything appeared to be unrelated so that's how we ended up at the possibility that the MetadataFilter was a problem.

Even my own stress testing on a sandbox idp to try to get the MetadataFilter to fail proved unsuccessful.

My own assessment of the problem might also be incorrect, but we have found nothing to explain how occasionally an SP will receive no attributes in the assertion.

I was curious if this was happening to anyone else.

- Steve