AttributeStatement differences IdP v3 → v4 ?

Fri Jul 1 01:14:22 UTC 2022

While upgrading from IdPv 3.2.1 to 4.2.1, we encountered a difference in
the way attributes are handled in the resulting SAML AttributeStatement.

For given AttributeDefinitions that happen to share the same Names, in 3.2
if we have an AttributeFilterPolicy that releases both attributes, they are
released separately. However, in 4.2 with a similar AttributeFilterPolicy,
the attributes appear to get merged. FWIW, the audit logs appear to show
the release of the separate attributes even in 4.2 where the released
AttributeStatement has merged the attributes.

I'm not sure if our original 3.2 configs were always "broken" and we were
just lucky it "worked" (in a way we had come to rely on), or maybe we're
doing it wrong in 4.2.

I've provided excerpts of our 3.2 and 4.2 AttributeDefinitions, resulting
AttributeStatements, and audit logs associated with this behavior below
using model attributes (attr_1, attr_2). The audit log field
templates differ for the versions, but both sets should include the
released attributes.

Are the 4.2 results we're observing expected and correct (we're presuming
it's not a bug)? If necessary, it appears we can avoid this by using
distinct Names for each of the attributes – which probably means working
with the affected SPs to accommodate the change, but is there an
alternate/better way to handle this?

3.2
###

attribute-resolver.xml:

    <!-- AttributeDefinition 1 -->
    <resolver:AttributeDefinition xsi:type="ad:Simple"
            id="attr_1"
            sourceAttributeID="attr_1" >
        <resolver:Dependency ref="LDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
                name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"
                friendlyName="attr_1" />
    </resolver:AttributeDefinition>

    <!-- AttributeDefinition 2 -->
    <resolver:AttributeDefinition xsi:type="ad:Mapped"
            id="attr_2"
            sourceAttributeID="attr_1">
        <resolver:Dependency ref="LDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
                name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"
                friendlyName="attr_2" />
        <ad:ValueMap>
            <ad:ReturnValue>BAR</ad:ReturnValue>
            <ad:SourceValue ignoreCase="true">BAZ</ad:SourceValue>
        </ad:ValueMap>
    </resolver:AttributeDefinition>

AttributeFilterPolicy results:

    <!-- AttributeFilterPolicy 1 - (release attr_1) -->
    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="attr_1"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"

xsi:type="xsd:string">FOO</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>

2022-06-30
14:04:26,091|20220701T000426Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_23ef84ccb6e0adc2f21f7b84589ae0fd|
https://samltest.id/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp32.example.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_d51b26151a5006ea067649c785128872|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|attr_1|AAdzZWNyZXQxsJHnmdyFeYtznAraXU17UOYRGfbtdh14bIQ5pqW/RCmBMHul+hcY7jt54EG+Sk2zpDcdv8fmsg7U0Wh5j7OFguN9We6ldZfkFbjlU9wIHbT4hF5g0D1XMOxBcUE=|_8bc550db007797b7b982964b4cea524e|||10.10.10.10|
<https://samltest.id/saml/sp%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp32.example.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_d51b26151a5006ea067649c785128872%7Cbaron%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7Cattr_1%7CAAdzZWNyZXQxsJHnmdyFeYtznAraXU17UOYRGfbtdh14bIQ5pqW/RCmBMHul+hcY7jt54EG+Sk2zpDcdv8fmsg7U0Wh5j7OFguN9We6ldZfkFbjlU9wIHbT4hF5g0D1XMOxBcUE=%7C_8bc550db007797b7b982964b4cea524e%7C%7C%7C10.10.10.10%7C>

    <!-- AttributeFilterPolicy 2 - (release attr_2) -->
    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="attr_2"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"

xsi:type="xsd:string">BAR</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>

2022-06-30
14:10:26,950|20220701T001026Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_132f15e8634d7b2e0f38328212498391|
https://samltest.id/saml/sp|http://shibboleth.net/ns/profiles/saml2/example/browser|https://idp32.example.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_bf4de8616a7f1a4aedddd8dd42506833|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|attr_2|AAdzZWNyZXQxwT/OOqs305V2phU5qgPmb4qF5FghqGVhmbDrN/pxNbDZsQYaLHn8l7tVTX4rZQ/OF8MUmResPo57+qNZqCF7RWqc31pPocql6goiF7dpZ2TqdJqvNpdNDSMv160=|_2b9aceaa9fabb3bd68db8fb27e06ea3f|||10.10.10.10|
<https://samltest.id/saml/sp%7Chttp://shibboleth.net/ns/profiles/saml2/example/browser%7Chttps://idp32.example.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_bf4de8616a7f1a4aedddd8dd42506833%7Cbaron%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7Cattr_2%7CAAdzZWNyZXQxwT/OOqs305V2phU5qgPmb4qF5FghqGVhmbDrN/pxNbDZsQYaLHn8l7tVTX4rZQ/OF8MUmResPo57+qNZqCF7RWqc31pPocql6goiF7dpZ2TqdJqvNpdNDSMv160=%7C_2b9aceaa9fabb3bd68db8fb27e06ea3f%7C%7C%7C10.10.10.10%7C>

    <!-- AttributeFilterPolicy 1+2 - (release attr_1, attr_2) -->
    <saml2:AttributeStatement>
        <saml2:Attribute FriendlyName="attr_1"
Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue xmlns:xsd="
http://www.w3.org/2001/XMLSchema" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">FOO-grouping-init</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="attr_2"
Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue xmlns:xsd="
http://www.w3.org/2001/XMLSchema" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">BAR</saml2:AttributeValue>
        </saml2:Attribute>
    </saml2:AttributeStatement>

    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="attr_1"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"

xsi:type="xsd:string">FOO</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute FriendlyName="attr_2"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"

xsi:type="xsd:string">BAR</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>

*** Note attr_1 and attr_2 released as separate attributes with the Names
from their respective AttributeDefinitions

2022-06-30
14:13:41,870|20220701T001341Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_f6d2231464cb43dcfaaed857ab523e87|
https://samltest.id/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp32.example.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_04943c047dfec7bb037e79c166b2b0bb|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|attr_1,attr_2|AAdzZWNyZXQxARArW6Ewjx/RNZVm/PGJrPM0bJ387ArgF8V9oM1Yd5WmHJM9yKe0EhbOniCfgil8ZaKTYcALHmbmFkgbQl8zTy/65ti4+Nr6oOt1D/NizKev9sTB1nk6xMq2L48=|_798eff004268eca113659fd4c4423c4c|||10.10.10.10|
<https://samltest.id/saml/sp%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp32.example.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_04943c047dfec7bb037e79c166b2b0bb%7Cbaron%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7Cattr_1,attr_2%7CAAdzZWNyZXQxARArW6Ewjx/RNZVm/PGJrPM0bJ387ArgF8V9oM1Yd5WmHJM9yKe0EhbOniCfgil8ZaKTYcALHmbmFkgbQl8zTy/65ti4+Nr6oOt1D/NizKev9sTB1nk6xMq2L48=%7C_798eff004268eca113659fd4c4423c4c%7C%7C%7C10.10.10.10%7C>

4.2
###

attribute-resolver.xml:

    <!-- AttributeDefinition 1 -->
    <AttributeDefinition id="attr_1" xsi:type="Simple">
        <InputDataConnector ref="LDAP" attributeNames="attr_1"/>
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999" friendlyName="attr_1"
encodeType="false" />
    </AttributeDefinition>

    <!-- AttributeDefinition 2 -->
    <AttributeDefinition id="attr_2" xsi:type="Mapped">
        <InputDataConnector ref="LDAP" attributeNames="attr_1" />
        <DefaultValue passThru="false"/>
        <ValueMap>
            <ReturnValue>BAR</ReturnValue>
            <SourceValue caseSensitive="true">BAZ</SourceValue>
        </ValueMap>
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999" friendlyName="attr_2" />
     </AttributeDefinition>

AttributeFilterPolicy results:
    <!-- AttributeFilterPolicy 1 - (release attr_1) -->
    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="attr_1"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>FOO</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>

2022-06-30 14:20:45.730-1000|2022-06-30
14:20:11.881-1000|10.17.133.34|baron|
https://samltest.id/saml/sp|_09f74daf40351ffa693fa611db3f0c75|password|2022-06-30
14:20:45.579-1000|attr_1|||false|false||Redirect|POST||Success|||Mozilla/5.0
(Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/102.0.0.0 Safari/537.36

    <!-- AttributeFilterPolicy 2 - (release attr_2) -->
    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="attr_2"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>BAR</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>

2022-06-30 14:24:55.783-1000|2022-06-30
14:24:38.863-1000|10.17.133.34|baron|
https://samltest.id/saml/sp|_6402066046dcdf0373d8b4e0d6a4595d|password|2022-06-30
14:24:55.669-1000|attr_2|||false|false||Redirect|POST||Success|||Mozilla/5.0
(Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/102.0.0.0 Safari/537.36

    <!-- AttributeFilterPolicy 1+2 - (release attr_1, attr_2) -->
    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="attr_1"
                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"

 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>FOO-test-1</saml2:AttributeValue>
        <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"

xsi:type="xsd:string">BAR</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>

*** Note attr_1 and attr_2 apparently merged into attr_1

2022-06-30 14:27:16.522-1000|2022-06-30
14:27:01.206-1000|10.17.133.34|baron|
https://samltest.id/saml/sp|_78d37f58dd1627d0ecce8d7daa2dffe0|password|2022-06-30
14:27:16.406-1000|attr_1,attr_2|||false|false||Redirect|POST||Success|||Mozilla/5.0
(Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/102.0.0.0 Safari/537.36

-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220630/5179fb51/attachment.htm>