Duplicate attribute values in IdP 4.2

[Baron Fujimoto]

I see now this comment in our services.xml:

    <!--
    This is suitable for new installs but will usually produce duplicate
Attribute
    output if a legacy resolver file is used that contains
AttributeEncoders.
    -->
    <util:list id ="shibboleth.AttributeRegistryResources">
        <value>%{idp.home}/conf/attribute-registry.xml</value>
        <value>%{idp.home}/conf/attributes/default-rules.xml</value>
        <value>%{idp.home}/conf/attribute-resolver.xml</value>
        <!-- Custom activation conditions -->
        <value>%{idp.home}/conf/activation-condition.xml</value>
    </util:list>

So presumably this is the cause. We hadn't yet configured any
AttributeRegistry, but it looks like that is the way forward?

On Fri, May 13, 2022 at 12:16 PM Baron Fujimoto <baron at hawaii.edu> wrote:

> We're upgrading from 3.2.1 to 4.2.1. I've noticed that with 4.2.1, we are
> seeing duplicate attribute values in our attribute resolver tests and SAML
> responses for the same attribute definition.
> E.g. for givenName, this was what we used in attribute-resolver.xml for
> 3.2.1, and the same is being used in our 4.2.1 conf:
>
>     <AttributeDefinition id="givenName" xsi:type="Simple">
>         <InputDataConnector ref="UH_LDAP" attributeNames="givenName"/>
>         <AttributeEncoder xsi:type="SAML1String"
> name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
>         <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42"
> friendlyName="givenName" encodeType="false" />
>     </AttributeDefinition>
>
> With 3.2.1, a resolver test resulted in the following:
>
>     <saml2:AttributeStatement>
>         <saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue xmlns:xsd="
> http://www.w3.org/2001/XMLSchema" xmlns:xsi="
> http://www.w3.org/2001/XMLSchema-instance"
> xsi:type="xsd:string">Baron</saml2:AttributeValue>
>         </saml2:Attribute>
>     </saml2:AttributeStatement>
>
> Whereas with 4.2.1 we get the attribute value duplicated:
>
>     <saml2:AttributeStatement>
>         <saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue>Baron</saml2:AttributeValue>
>             <saml2:AttributeValue>Baron</saml2:AttributeValue>
>         </saml2:Attribute>
>     </saml2:AttributeStatement>
>
> This appears to be due the fact that we have multiple AttributeEncoders in
> our attribute definition, since we don't see this when there is only one
> attribute encoder.
>
> Is this expected, or is there a way to restore the previous de-duplicating
> behavior? Is there a better way to do this? Does it matter? (It seems more
> confusing to be duplicated)
>
> --
> Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
>


-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220513/20905a12/attachment.htm>