Administrative Logout using Attribute-Based Revocation

Mon Feb 10 10:53:23 UTC 2025

Hi all,

### Operating Environment Information
operating_system: Linux
operating_system_version: 4.18.0-553.36.1.el8_10.x86_64
operating_system_architecture: amd64
jdk_version: 17.0.14
available_cores: 2
used_memory: 144 MB
maximum_memory: 256 MB

### Identity Provider Information
idp_version: 5.1.3

I'm trying to configure Revocation based on openLDAP's attribute pwdChangedTime  since we want to invalidate all sessions once a users password has changed.
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506431/AdministrativeLogoutConfiguration#Attribute-Based-Revocation

To do this I have used this configuration

conf/authn/authn.properties

  *
idp.authn.revocation = true
  *
idp.authn.revocation.attributeId = 'revocation'
  *
idp.authn.revocation.Condition = 'shibboleth.AttributeRevocationCondition'

conf/attribute-resolver.xml

  <AttributeDefinition id="revocation" xsi:type="DateTime"  epochInSeconds="true">
    <InputDataConnector ref="ldap" attributeNames="pwdChangedTime" />
    <AttributeEncoder xsi:type="SAML2DateTime " name="revocation" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" friendlyName="revocation" encodeType="false" />
  </AttributeDefinition>

idp-process.log

2025-02-10 21:14:17,183 -  - DEBUG [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:89] - Parsing configuration for AttributeDefinition plugin with id: revocation
2025-02-10 21:14:18,329 -  - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:669] - Attribute Resolver 'ShibbolethAttributeResolver': Checking if attribute definition 'revocation' has a circular dependency
2025-02-10 21:14:18,496 -  - DEBUG [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:89] - Parsing configuration for AttributeDefinition plugin with id: revocation
2025-02-10 21:14:18,660 -  - DEBUG [net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl:345] - Attribute mapping: revocation <-> SAML2:{urn:oasis:names:tc:SAML:2.0:attrname-format:uri}revocation via SAML2DateTimeAttributeTranscoder
2025-02-10 21:17:07,306 -  - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:279] - Registered flow ID 'admin/revocation' using 'class path resource [net/shibboleth/idp/flows/admin/revocation-flow.xml]'
2025-02-10 21:17:07,325 -  - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:279] - Registered flow ID 'oauth2/revocation' using 'URL [jar:file:/opt/apache-tomcat-10.1.25/webapps/idp/WEB-INF/lib/idp-plugin-oidc-op-impl-4.1.0.jar!/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml]'

2025-02-10 21:17:31,546 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:455] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'revocation'
2025-02-10 21:17:31,547 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:131] - Attribute Definition 'revocation': produced an attribute with no values
2025-02-10 21:17:31,547 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:336] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'revocation' produced an attribute with 0 values
2025-02-10 21:17:31,583 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:466] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null filtering) attribute definition revocation result
2025-02-10 21:17:31,583 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:528] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'revocation', contains no values
2025-02-10 21:17:46,624 - 192.168.75.2 - DEBUG [net.shibboleth.idp.authn.revocation.impl.AttributeRevocationCondition:168] - Checking revocation for principal name REDACTED for authn/Password result via attribute resolver

The main issue appears to be that the attribute definition "revocation" returns no values. Have I got the definition correct?

ldapsearch returns the attributes for the ldap account configured in ldap.properties

      dn: uid=glipscom,REDACTED,REDACTED.edu.au

cn: Gary Lipscomb
mail: glipscomb at csu.edu.au
pwdChangedTime: 20250209221240Z

These are the AttributeDefinition's I tried all resulting in no values retrieved

  <AttributeDefinition id="revocation" xsi:type="DateTime"  epochInSeconds="true">
    <InputDataConnector ref="ldap" attributeNames="pwdChangedTime" />
    <AttributeEncoder xsi:type="SAML2DateTime " name="revocation" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" friendlyName="revocation" encodeType="false" />
  </AttributeDefinition>
  <AttributeDefinition id="pwdChangedTime" xsi:type="DateTime" epochInSeconds="true">
    <InputDataConnector ref="ldap" attributeNames="pwdChangedTime" />
  </AttributeDefinition>
  <AttributeDefinition id="authTimestamp" xsi:type="Simple">
    <InputDataConnector ref="ldap" attributeNames="authTimestamp" />
  </AttributeDefinition>

regards
Gary

Gary Lipscomb

Technical Officer, Systems

IT Infrastructure & Security | Division of Information Technology

[Charles Sturt]<https://www.csu.edu.au>

________________________________

LEGAL NOTICE

This email (including correspondence comprising an email chain and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone.
Any confidentiality is not waived or lost by reason of mistaken delivery. Any email should be checked for viruses and defects before opening. Charles Sturt University does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with Charles Sturt University may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at Charles Sturt University. The views expressed in this email are not necessarily those of Charles Sturt University.

Charles Sturt University in Australia<https://www.csu.edu.au> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551). Charles Sturt University - TEQSA Provider Identification: PRV12018 (Australian University). CRICOS Provider: 00005F.

Consider the environment before printing this email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250210/dad52245/attachment.htm>