attribute-map.xml changes not visible in apache

[David Balažic]

News regarding the issue:

In https://servername/Shibboleth.sso/Session we see the "missing token is present":

Attributes
Foo_attr: 1 value(s)
...


So it is probably getting lost in the apache part?


David Balažic

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Wednesday, 3 February 2021 17:29
To: Shib Users <users at shibboleth.net>
Subject: Re: attribute-map.xml changes not visible in apache [dkim]

CAUTION: Origin is external! The content might not be safe!


On 2/3/21, 10:58 AM, "users on behalf of David Balažic" <users-bounces at shibboleth.net on behalf of David.Balazic at comtrade.com> wrote:

>    Where to look?

If the transaction log shows it cached the relevant attribute ID then it's definitely there and would be getting populated. I would probably use a CGI script to dump the Apache environment and verify that it's present on that end. After that, there's nothing else to check.

The reason the rules don't reload, aside from the actual setting that tells it not to reload them, is that headers are insecure and the "this likely only works until it doesn't" trick to clear them out relies on knowing what the possible headers are, so when the rules change, all sides have to be fully in sync to prevent a security hole. Not reloading it prevents things from falling out of sync.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net