IdPv3 to v4 : Consent for multi-valued attributes?

[Martin Haase]

Hi,

I had attribute consent in a v3 with the "ask again if information
changes" setting for this user. This is how that attribute arrived at
the SP:

<saml2:Attribute FriendlyName="eduPersonAffiliation"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>member</saml2:AttributeValue><saml2:AttributeValue>staff</saml2:AttributeValue><saml2:AttributeValue>employee</saml2:AttributeValue></saml2:Attribute>

Now I updated this IdP to v4 in-place, and wondered why I got a consent
page. The logs say:

2020-09-24 18:02:23,306 - DEBUG
[net.shibboleth.idp.consent.logic.impl.IsConsentRequiredPredicate:119] -
Consent is required, previous consent 'Consent{id=eduPersonAffiliation,
value=JyYPSRN7zLvppoQpEI81UNsNWXg2Qd+9uyrM+Sts/tE=, isApproved=true}'
does not match current consent 'Consent{id=eduPersonAffiliation,
value=JTNvd6INN+7PtGsY0gTDGyXP0ReQlvcG7yB39QfnW2o=, isApproved=false}'

At the SP, the attribute has the same values, but... staff and employee
changed their order.

<saml2:Attribute FriendlyName="eduPersonAffiliation"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>member</saml2:AttributeValue><saml2:AttributeValue>employee</saml2:AttributeValue><saml2:AttributeValue>staff</saml2:AttributeValue></saml2:Attribute>

Looks like the hash got computed based on an unsorted array. Is there
anything one can do about that (I guess not, and sparing the users the
re-consenting would not be worth that effort)?

Cheers

Martin



-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz