Exporting SP attribute policy decisions to the application

[Guillaume Rousse]

Hello.

The attribute filtering mechanism built in the service provider offers a 
great deal of control over attributes values, in particular scoped 
attributes with invalid scopes.

However, it also makes the underlying application unable to make a 
distinction between a missing attribute, and a attribute present with an 
invalid value. AFAIK, the information is only available in the SP logs, 
for instance:
WARN Shibboleth.AttributeFilter [1] [default]: attribute (subject-id) 
invalid scope (domain.tld)
WARN Shibboleth.AttributeFilter [1] [default]: removed value at position 
(0) of attribute (subject-id) from 
(https://idp.formation.lab/idp/shibboleth)
16:42:56 WARN Shibboleth.AttributeFilter [1] [default]: no values left, 
removing attribute (subject-id) from 
(https://idp.formation.lab/idp/shibboleth)

While perfectly reasonable in most situation, this behaviour is 
sometimes counter-productive. For a conformity testing application, for 
instance, we'd like to explain the issue to the user, by providing an 
explicit message "invalid scope used (domain.tld) instead of expected 
one (another.tld), instead of "missing subject-id attribute".

Here are a few solutions that I considere so far.

The first one would be to disable attribute filtering in the SP, and 
doing all filtering in the application. This would require the SP to 
export some metadata information, such as the list of allowed scopes, 
for instance, using the metadata attribute extractor.

The second one would be to leave the SP filtering in place, but to also 
export raw SAML assertions using the GetAssertion handler, so as to make 
the application able to attributes list with assertions lists, and 
deduce filtering issues from discrepancies.

The third one would be to make the application parse the SP logs, which 
seem prone to problems due to concurrent access and buffering issues.

But maybe there are other solutions ?

Regards.
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4291 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20251107/612b3bc1/attachment.p7s>