Some attributes are duplicated in response

[Steven Premeau]

I have seen this when you have AttributeEncoders in both your
attribute-resolver configuration and the Attribute Registry configuration.

In your example, all of the attributes should have an encoding
configuration defined in conf/attributes/eduPerson.xml ... so you would
want to remove any encoding configuration from the AttributeDefintion block
within your resolve.

Steve.

On Fri, Oct 25, 2024 at 12:34 PM Conner, Mike via users <
users at shibboleth.net> wrote:

> I wonder if anyone could help me troubleshoot an issue I haven't been able
> to understand. My Shib IdP is adding duplicate attribute values to the
> outgoing assertion.
> In the logs it appears that eduPersonScopedAffiliation has 1 value,
> eduPersonAffiliation has 1 value and eduPersonAssurance has 4 values.
> When these values are added and encoded for the assertion, they are
> duplicated.
> Where and why is this happening?
>
> *** LOGS ***
> DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] -
> Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
> attribute 'eduPersonAffiliation' remained after filtering
> DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] -
> Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
> attribute 'eduPersonScopedAffiliation' remained after filtering
> DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] -
> Attribute filtering engine 'ShibbolethAttributeFilter': 4 values for
> attribute 'eduPersonAssurance' remained after filtering
> ...
> DEBUG
> [net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:265]
> - Profile Action AddAttributeStatementToAssertion: Attempting to add an
> AttributeStatement to outgoing Assertion
> DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute eduPersonAssurance as a SAML 2 Attribute
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance of attribute
> eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance/ID/eppn-unique-reassign-1y of
> attribute eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance/IAP/low of attribute
> eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance/IAP/medium of attribute
> eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance of attribute
> eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance/ID/eppn-unique-reassign-1y of
> attribute eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance/IAP/low of attribute
> eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value https://refeds.org/assurance/IAP/medium of attribute
> eduPersonAssurance
> DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute eduPersonScopedAffiliation as a SAML 2 Attribute
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value member at grinnell.edu of attribute eduPersonScopedAffiliation
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value member at grinnell.edu of attribute eduPersonScopedAffiliation
> DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute eduPersonAffiliation as a SAML 2 Attribute
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value member of attribute eduPersonAffiliation
> DEBUG
> [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] -
> Encoding value member of attribute eduPersonAffiliation
> *** END LOGS ***
>
> *** RESULTING ASSERTION ***
> <saml2:AttributeStatement>
>             <saml2:Attribute FriendlyName="eduPersonAssurance"
>                              Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11"
>
>  NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
>                              >
>                 <saml2:AttributeValue>https://refeds.org/assurance
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>
> https://refeds.org/assurance/ID/eppn-unique-reassign-1y
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>https://refeds.org/assurance/IAP/low
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>
> https://refeds.org/assurance/IAP/medium</saml2:AttributeValue>
>                 <saml2:AttributeValue>https://refeds.org/assurance
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>
> https://refeds.org/assurance/ID/eppn-unique-reassign-1y
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>https://refeds.org/assurance/IAP/low
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>
> https://refeds.org/assurance/IAP/medium</saml2:AttributeValue>
>             </saml2:Attribute>
>             <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
>                              Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
>
>  NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
>                              >
>                 <saml2:AttributeValue>member at grinnell.edu
> </saml2:AttributeValue>
>                 <saml2:AttributeValue>member at grinnell.edu
> </saml2:AttributeValue>
>             </saml2:Attribute>
>             <saml2:Attribute FriendlyName="eduPersonAffiliation"
>                              Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
>
>  NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
>                              >
>                 <saml2:AttributeValue xmlns:xsi="
> http://www.w3.org/2001/XMLSchema-instance"
>                                       xsi:type="xsd:string"
>                                       >member</saml2:AttributeValue>
>                 <saml2:AttributeValue>member</saml2:AttributeValue>
>             </saml2:Attribute>
> *** END ASSERTION ***
>
> Internal
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241025/04217ee4/attachment.htm>