Some attributes are duplicated in response

Conner, Mike CONNERMS at Grinnell.EDU
Fri Oct 25 17:46:13 UTC 2024 

Thank you Steve! That resolved the issue.


Internal

________________________________
From: Steven Premeau <steven.premeau at maine.edu>
Sent: Friday, October 25, 2024 11:40 AM
To: Shib Users <users at shibboleth.net>
Cc: Conner, Mike <CONNERMS at Grinnell.EDU>
Subject: Re: Some attributes are duplicated in response

Caution: External Email
I have seen this when you have AttributeEncoders in both your attribute-resolver configuration and the Attribute Registry configuration.

In your example, all of the attributes should have an encoding configuration defined in conf/attributes/eduPerson.xml ... so you would want to remove any encoding configuration from the AttributeDefintion block within your resolve.

Steve.

On Fri, Oct 25, 2024 at 12:34 PM Conner, Mike via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:
I wonder if anyone could help me troubleshoot an issue I haven't been able to understand. My Shib IdP is adding duplicate attribute values to the outgoing assertion.
In the logs it appears that eduPersonScopedAffiliation has 1 value, eduPersonAffiliation has 1 value and eduPersonAssurance has 4 values.
When these values are added and encoded for the assertion, they are duplicated.
Where and why is this happening?

*** LOGS ***
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'eduPersonAffiliation' remained after filtering
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'eduPersonScopedAffiliation' remained after filtering
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter': 4 values for attribute 'eduPersonAssurance' remained after filtering
...
DEBUG [net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:265] - Profile Action AddAttributeStatementToAssertion: Attempting to add an AttributeStatement to outgoing Assertion
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonAssurance as a SAML 2 Attribute
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=YWD6blnrAohwQCnlKNydFDFp-p9GgP3vKYT16UgUdwg&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/ID/eppn-unique-reassign-1y<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_ID_eppn-2Dunique-2Dreassign-2D1y&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=zIC1CinNvyUJvGndfq7lE0EHPsrKz7v1WHnClXqS83c&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/low<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_low&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=09Kk2Qbp5vb6a5UcO14seNTQSqN_UU_SmJxkBJ2HJ_0&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/medium<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_medium&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=4A6uCfpJ0WmEgRfyZOpn9P-y2zcw9zfXvMeuDmuBJK4&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=YWD6blnrAohwQCnlKNydFDFp-p9GgP3vKYT16UgUdwg&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/ID/eppn-unique-reassign-1y<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_ID_eppn-2Dunique-2Dreassign-2D1y&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=zIC1CinNvyUJvGndfq7lE0EHPsrKz7v1WHnClXqS83c&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/low<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_low&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=09Kk2Qbp5vb6a5UcO14seNTQSqN_UU_SmJxkBJ2HJ_0&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/medium<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_medium&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=4A6uCfpJ0WmEgRfyZOpn9P-y2zcw9zfXvMeuDmuBJK4&e=> of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonScopedAffiliation as a SAML 2 Attribute
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member at grinnell.edu<mailto:member at grinnell.edu> of attribute eduPersonScopedAffiliation
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member at grinnell.edu<mailto:member at grinnell.edu> of attribute eduPersonScopedAffiliation
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonAffiliation as a SAML 2 Attribute
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member of attribute eduPersonAffiliation
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member of attribute eduPersonAffiliation
*** END LOGS ***

*** RESULTING ASSERTION ***
<saml2:AttributeStatement>
            <saml2:Attribute FriendlyName="eduPersonAssurance"
                             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue>https://refeds.org/assurance<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=YWD6blnrAohwQCnlKNydFDFp-p9GgP3vKYT16UgUdwg&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/ID/eppn-unique-reassign-1y<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_ID_eppn-2Dunique-2Dreassign-2D1y&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=zIC1CinNvyUJvGndfq7lE0EHPsrKz7v1WHnClXqS83c&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/low<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_low&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=09Kk2Qbp5vb6a5UcO14seNTQSqN_UU_SmJxkBJ2HJ_0&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/medium<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_medium&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=4A6uCfpJ0WmEgRfyZOpn9P-y2zcw9zfXvMeuDmuBJK4&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=YWD6blnrAohwQCnlKNydFDFp-p9GgP3vKYT16UgUdwg&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/ID/eppn-unique-reassign-1y<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_ID_eppn-2Dunique-2Dreassign-2D1y&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=zIC1CinNvyUJvGndfq7lE0EHPsrKz7v1WHnClXqS83c&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/low<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_low&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=09Kk2Qbp5vb6a5UcO14seNTQSqN_UU_SmJxkBJ2HJ_0&e=></saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/medium<https://urldefense.proofpoint.com/v2/url?u=https-3A__refeds.org_assurance_IAP_medium&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=4A6uCfpJ0WmEgRfyZOpn9P-y2zcw9zfXvMeuDmuBJK4&e=></saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
                             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue>member at grinnell.edu<mailto:member at grinnell.edu></saml2:AttributeValue>
                <saml2:AttributeValue>member at grinnell.edu<mailto:member at grinnell.edu></saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="eduPersonAffiliation"
                             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_XMLSchema-2Dinstance&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=mRruGWXu2pLL-SfY9QtH0gyfViUP2hgyGH-tQOh4eMs&e=>"
                                      xsi:type="xsd:string"
                                      >member</saml2:AttributeValue>
                <saml2:AttributeValue>member</saml2:AttributeValue>
            </saml2:Attribute>
*** END ASSERTION ***


Internal

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwMFaQ&c=HUrdOLg_tCr0UMeDjWLBOM9lLDRpsndbROGxEKQRFzk&r=LqMeO26Up0EGFv2SdZSL1eTDLrQ5j0_TQWPLaAmPZ_o&m=FstQq8Isy6LhpVWq-lwm-Nn2vEE8OpNGS0ipwyRNhYUm4krNINcZn7_RpFAKjnqS&s=ZwqXhAY0rOaE8OagdYUb9WxVshqQ6OSXljj7vWfpfu4&e=>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
This email was sent from outside Grinnell College. Treat attachments and links with caution. If this message looks suspicious, use the report phish button.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241025/99809f90/attachment.htm>

More information about the users mailing list