Empty 'shibmlp target' at AttributeChecker

[Pavel Šipoš]

Hi.

I am trying to configure attribute checker following these instructions:
- 
https://wiki.geant.org/display/eduGAIN/How+to+configure+Shibboleth+SP+attribute+checker 
,
- https://github.com/CSCfi/shibboleth-attrchecker .

I noticed that with Shibboleth SP version 3.2.1 or higher there is a 
problem getting `<shibmlp target />` value.
My guess is this is because of 
https://wiki.shibboleth.net/confluence/display/SP3/Errors :

 >Please be aware that in pre-3.2.1 versions or with the 
externalParameters setting enabled, tags can be populated using 
information supplied by the browser. While the information is HTML 
encoded in the template, please be wary of making yourself vulnerable to 
XSS attacks or simple phishing attempts.

If I enable externalParameters at Error block then `<shibmlp target />` 
is populated correctly at attributeRelease handler, but as I don't want 
to risk XSS attacks I am not settisfied with this solution.

Is there a way to get SP entityID value and pass it to the 
attributeChecker template without setting externalParameters="true"?
This would allow me to have just one template for attribute checker as I 
have multiple SP running at one server ( I have multiple application 
overrides at shibboleth2.xml ).

I am not even shure if it is possible to have multiple AttributeChecker 
Handlers defined, one for each applicationOverride, each with own template.

Yours,
Pavel

-- 
--
Pavel Sipos, Arnes <pavel.sipos at arnes.si>
ARNES, p.p. 7, SI-1001 Ljubljana, Slovenia
T: +386 1 479 88 00
W: www.arnes.si, aai.arnes.si


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4211 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20210511/d6e7c76c/attachment.p7s>