Duplicate attributes released in IdP v4.0.1
Lipscomb, Gary
glipscomb at csu.edu.au
Fri Sep 4 05:24:05 UTC 2020
Hi list,
Environment
RHEL 7
IdP v4.0.1
Tomcat 9
JAVA java-11-openjdk
I'm currently building from scratch a v4 instance and noticing that some attributes are being released twice [1].
eduPersonAffiliation
eduPersonPrimaryAffiliation
uid
eduPersonAssurance
givenName
I've also done an inplace upgrade in our DEVEL environment and can't remember seeing this happening. That instance is currently unavailable and I can't confirm this just now.
When I use the definition below which contains
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" encodeType="false" />
<AttributeDefinition id="givenName" xsi:type="Simple">
<InputDataConnector ref="ldap" attributeNames="eduPersonNickname"/>
<DisplayName xml:lang="en">Given Name</DisplayName>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" encodeType="false" />
<AttributeEncoder xsi:type="oidcext:OIDCString" name="given_name" />
</AttributeDefinition>
I get the attribute returned twice as shown below
/opt/shibboleth-idp/bin/aacli.sh --saml2 -n glipscom -r https://validator.test.aaf.edu.au/shibboleth | grep -A2 givenName
<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Gazza</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Gazza</saml2:AttributeValue>
</saml2:Attribute>
If I modify the definition to have this line where the friendly name is changed from "givenName" to "Given Name"
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="Given Name" encodeType="false" />
<AttributeDefinition id="givenName" xsi:type="Simple">
<InputDataConnector ref="ldap" attributeNames="eduPersonNickname"/>
<DisplayName xml:lang="en">Given Name</DisplayName>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="Given Name" encodeType="false" />
<AttributeEncoder xsi:type="oidcext:OIDCString" name="given_name" />
</AttributeDefinition>
I only get the attribute returned once but with "giveName" as the FriendlyName.
/opt/shibboleth-idp/bin/aacli.sh --saml2 -n glipscom -r https://validator.test.aaf.edu.au/shibboleth | grep -A2 givenName
<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Gazza</saml2:AttributeValue>
</saml2:Attribute>
Does anyone have an idea what may be causing this?
Are changes required in the AttributeRegistry to overcome this?
Regards
Gary.
[1] aacli output
/opt/shibboleth-idp/bin/aacli.sh --saml2 -n glipscom -r https://validator.test.aaf.edu.au/shibboleth
<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_ded425d1f832585055eb80416f8c6802" IssueInstant="2020-09-04T04:50:30.899Z" Version="2.0">
<saml2:Issuer>https://idpdev.csu.edu.au/idp/shibboleth</saml2:Issuer>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://idpdev.csu.edu.au/idp/shibboleth" SPNameQualifier="https://validator.test.aaf.edu.au/shibboleth"> XXXXXX =</saml2:NameID>
</saml2:Subject>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>staff</saml2:AttributeValue>
<saml2:AttributeValue>member</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>staff</saml2:AttributeValue>
<saml2:AttributeValue>member</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonEntitlement" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>urn:mace:dir:entitlement:common-lib-terms</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonPrimaryAffiliation" Name="urn:oid: 1.3.6.1.4.1.5923.1.1.1.5" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>member</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonPrimaryAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>member</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="homeOrganizationType" Name="urn:oid:1.3.6.1.4.1.25178.1.2.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>urn:mace:terena.org:schac:homeOrganizationType:au:university</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>XXXX at XXXXXX.edu.au</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="auEduPersonSharedToken" Name="urn:oid:1.3.6.1.4.1.27856.1.2.5" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue> XXXXXX</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Gazza XXXXXX</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="o" Name="urn:oid:2.5.4.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Charles Sturt University</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue> XXXXXX</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>XXXXXX</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue> XXXXXX </saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>staff at csu.edu.au</saml2:AttributeValue>
<saml2:AttributeValue>member at csu.edu.au</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="schacPersonalUniqueID" Name="urn:oid:1.3.6.1.4.1.25178.1.2.15" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>urn:schac:personalUniqueID:au:csuid: XXXXXX </saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonAssurance" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>urn:mace:aaf.edu.au:iap:authn:1</saml2:AttributeValue>
<saml2:AttributeValue>urn:mace:aaf.edu.au:iap:id:1</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonAssurance" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>urn:mace:aaf.edu.au:iap:authn:1</saml2:AttributeValue>
<saml2:AttributeValue>urn:mace:aaf.edu.au:iap:id:1</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="employeeNumber" Name="urn:oid:2.16.840.1.113730.3.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue> XXXXXX</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Gazza</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>Gazza</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="homeOrganization" Name="urn:oid:1.3.6.1.4.1.25178.1.2.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue> XXXXXX.edu.au</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://idpdev.csu.edu.au/idp/shibboleth" SPNameQualifier="https://validator.test.aaf.edu.au/shibboleth">XXXXXX=</saml2:NameID>
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue> XXXXXX at XXXXXX.edu.au</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
| ALBURY-WODONGA | BATHURST | BRISBANE | CANBERRA | DUBBO | GOULBURN | MELBOURNE | ORANGE | PORT MACQUARIE | SYDNEY | WAGGA WAGGA |
LEGAL NOTICE
This email (and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone. Any confidentiality is not waived or lost by reason of mistaken delivery. Email should be checked for viruses and defects before opening. Charles Sturt University does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with Charles Sturt University may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at Charles Sturt University. The views expressed in this email are not necessarily those of Charles Sturt University.
Charles Sturt University in Australia The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551; CRICOS Provider Number: 00005F (National)). TEQSA Provider Number: PV12018
Consider the environment before printing this email.
More information about the users
mailing list