Attribute Transcoding errors following IdP upgrade

[Cantor, Scott]

On 9/22/20, 10:30 AM, "users on behalf of Simon McLeish" <users-bounces at shibboleth.net on behalf of simon.mcleish at gmail.com> wrote:

>    OK, so why would it not be loading the resolver file (in the extra lookup instance where it doesn't work) when it did
> before? And why does it still work for a "normal" authentication through the IdP?

Are you talking about an AttributeQuery? The only reason it would be any different with a query is if it's trying to filter attributes based on the request, so it would depend on what's in the request. That requires decoding the SAML Attribute, not encoding the IdP Attribute.

I would be looking closely at the logs at startup regarding the transcoding rules it installs based on the resolver and the logs in detail of the message in and what it's trying to decode at that point. The rules are all recorded at startup on DEBUG to get a full summary of them.

It's possible there's a NameFormat issue, and it's also possible the old code was broken/sloppy about handling that in some way.

And it's equally possible there's a bug because queries are practically unused at this point.

-- Scott