Overloaded shibd questions

[Nate Klingenstein]

> >    I didn't think even a passive rule would pass along no attributes, but it's not implausible there might be such a
> > code path since that approach implies it's ok not to have a session.

> Just to close the loop: there is, but it's logged.

> There are warnings in the authorization and exporting steps when it can't locate a session because of an exception raised (e.g. a ListenerException because shibd won't answer in time).

> So it would not be hidden by any means, the log would be full of those.

> But it will, if there's no rule in place to force it, just pass the request along undecorated.

Thanks for following up and verifying the hypothesis I was working on.  To clarify, I presume the log in reference is the one defined in native.logger.  We're getting no ListenerExceptions or anything in shibd.log, nor would I expect any, because of the fundamental nature of where things asplode.

I don't have access to native.log and was never sent a copy, but I will tomorrow, and the first thing we'll do is check that log to verify that we are having those issues.  Then remedial surgery can begin on demonstrable failure rather than a hunch.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id