Shib 4.0.1, repeated attributes in SAML assertions

[Jeffrey Williams]

An issue has cropped up in our dev environment where certain attributes are
being asserted twice in outgoing SAML assertions.  The debug logs seem to
indicate that the attributes in question are resolving with the expected
values and go through deduplication as one would expect.

However, the outgoing SAML assertion is logged and sent with certain
attributes having duplicate entries.  It seems to be the same attributes
each time.

example:

<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_072e286791964ec69c0c9372562be01e"
IssueInstant="2021-02-19T21:46:14.418Z" Version="2.0">
    <saml2:Issuer>https://idp-dev.uncg.edu/idp/shibboleth</saml2:Issuer>
    <saml2:Subject>
        <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="
https://idp-dev.uncg.edu/idp/shibboleth" SPNameQualifier="
https://grouper-dev.uncg.edu/shibboleth
">AAdzZWNyZXQx34D2/aUC9R0pNqQn1nhI08v17fteNQ3RdeVYCJ+ApE6Aay+v7nJBWnBl8OHUXpiNwc038I3el2iKAp6mgpkVGKb3hYZcMjCmH7AYr4CwC764OJ8g9kz1ZfI7sHhvc9XY1+7UVUmjK+MyNmyKYa0=</saml2:NameID>
        <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml2:SubjectConfirmationData Address="10.80.212.191"
InResponseTo="_3423a6a3d43cb1aab0d46e62b785029b"
NotOnOrAfter="2021-02-19T21:51:14.472Z" Recipient="
https://grouper-dev.uncg.edu/Shibboleth.sso/SAML2/POST"/>
        </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="2021-02-19T21:46:14.418Z"
NotOnOrAfter="2021-02-19T21:51:14.418Z">
        <saml2:AudienceRestriction>
            <saml2:Audience>https://grouper-dev.uncg.edu/shibboleth
</saml2:Audience>
        </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="2021-02-19T21:46:13.559Z"
SessionIndex="_cba6ccf7163e4d1f47be3fc0b553cf7d">
        <saml2:SubjectLocality Address="10.80.212.191"/>
        <saml2:AuthnContext>
            <saml2:AuthnContextClassRef>https://refeds.org/profile/mfa
</saml2:AuthnContextClassRef>
        </saml2:AuthnContext>
    </saml2:AuthnStatement>
    <saml2:AttributeStatement>
        <saml2:Attribute FriendlyName="uidNumber"
Name="urn:oid:1.3.6.1.1.1.1.0"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue xmlns:xsd="
http://www.w3.org/2001/XMLSchema" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">080808</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="cn" Name="urn:oid:2.5.4.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue xmlns:xsd="
http://www.w3.org/2001/XMLSchema" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">JFWILLIA</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="cn" Name="urn:oid:2.5.4.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue xmlns:xsd="
http://www.w3.org/2001/XMLSchema" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">JFWILLIA</saml2:AttributeValue>
        </saml2:Attribute>
    </saml2:AttributeStatement>
</saml2:Assertion>

Since I'm not 100% on when the issue began, I've been backing out changes
for a while to see if it stops.  No such luck yet.  Does anyone have any
suggestions about where to look in order to determine what would be causing
such behavior?

Thanks!


-- 
Jeffrey Williams
Identity & Access Engineer
Identity & Access Services
https://its.uncg.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210219/c34c91dd/attachment.htm>