<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">With MCB, Duo, and LDAP caching in my IdP 2.4.0, I am seeing double or triple (if 2FA) copies of eduPersonAffiliation in the SAML assertion:<div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Member</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Staff</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Employee</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2:Attribute></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Member</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Staff</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Employee</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2:Attribute></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Member</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Staff</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Employee</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2:Attribute></div></div><div><br></div><div><br></div><div>No other attributes are similarly triplicated. I supposed some poor behavior of my script that adds value of Member or Affiliate since those aren’t in the LDAP (below), but when I commented out the cache statement in the data connector,</div><div>normal behavior resumed. I’d like to enable caching since the MCB + Duo combination runs the attribute resolver 2 or 3 times, but don’t see how to avoid the redundant ePA assertions.</div><div><br></div><div>...</div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"><!-- <Result<span style="color: #0220b3; background-color: #e6e600">Cache</span> elementTimeToLive="PT1H" maximum<span style="color: #0220b3; background-color: #e6e600">Cache</span>dElements="100"/> --></div></div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span></<span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span>DataConnector></div></div><div><br></div><div>….</div><div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(184, 184, 184);"><!-- eduPersonAffiliation from LDAP values with Member or Affiliated added as needed --></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"><resolver:AttributeDefinition </span><span style="color: #098021">xsi:type=</span>"Script"<span style="color: #091480"> </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:resolver:ad"</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"> </span><span style="color: #098021">id=</span>"eduPersonAffiliation"</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"> </span><span style="color: #098021">sourceAttributeID=</span>"eduPersonAffiliation"<span style="color: #091480">></span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51); min-height: 16px;"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"><span style="color: #323333"> </span><resolver:Dependency <span style="color: #098021">ref=</span><span style="color: #ff9300">"myLDAP"</span> /></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(184, 184, 184);"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #323333"> </span><span style="color: #091480"><resolver:AttributeEncoder </span><span style="color: #098021">xsi:type=</span>"SAML1String"<span style="color: #091480"> </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"> </span><span style="color: #098021">name=</span>"urn:mace:dir:attribute-def:eduPersonAffiliation"<span style="color: #091480"> /></span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #323333"> </span><span style="color: #091480"><resolver:AttributeEncoder </span><span style="color: #098021">xsi:type=</span>"SAML2String"<span style="color: #091480"> </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"> </span><span style="color: #098021">name=</span>"urn:oid:1.3.6.1.4.1.5923.1.1.1.1"</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"> <span style="color: #098021">friendlyName=</span><span style="color: #ff9300">"eduPersonAffiliation"</span> /></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(184, 184, 184);"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(75, 90, 125);"><span style="color: #323333"> </span><span style="color: #091480"><Script></span><![CDATA[</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> importPackage(Packages.org.slf4j);</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> logger = LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.scriptTest");</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"><span class="Apple-tab-span" style="white-space:pre"> </span>logger.debug(" ePA script; starting ePA values: " + eduPersonAffiliation.getValues()); </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51); min-height: 16px;"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);">// Manipulate values only if eduPersonAffiliation directory value(s) exist</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);">if (typeof eduPersonAffiliation != "undefined" && eduPersonAffiliation != null) {</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> // Add attribute value "Member" if entailed by other affiliation</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> if (eduPersonAffiliation.getValues().contains("Student") </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> || eduPersonAffiliation.getValues().contains("Employee")</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> || eduPersonAffiliation.getValues().contains("Staff")</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> || eduPersonAffiliation.getValues().contains("Faculty")) </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> { </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> if (!(eduPersonAffiliation.getValues().contains("Member"))) {eduPersonAffiliation.getValues().add("Member");}</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"><span class="Apple-tab-span" style="white-space:pre"> </span>logger.debug(" ePA script: include Member; ePA values: " + eduPersonAffiliation.getValues()); </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> }</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);">}</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);">// Otherwise, create if null</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> else</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"><span class="Apple-tab-span" style="white-space:pre"> </span>if (eduPersonAffiliation == null) {eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");}</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"><span class="Apple-tab-span" style="white-space:pre"> </span>logger.debug(" ePA script non-S/E/S/F; ePA values: " + eduPersonAffiliation.getValues()); </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51); min-height: 16px;"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);">// Add Affiliate if neither Member nor Affiliate </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> if ( !(eduPersonAffiliation.getValues().contains("Affiliate")) && !(eduPersonAffiliation.getValues().contains("Member")) ) </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> {eduPersonAffiliation.getValues().add("Affiliate");</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"><span class="Apple-tab-span" style="white-space:pre"> </span>logger.debug(" ePA script add Affiliate; ePA values: " + eduPersonAffiliation.getValues());</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> }</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"><span style="color: #323333"> </span><span style="color: #4b5a7d">]]></span></Script></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"></resolver:AttributeDefinition></div></div><div><br></div><div>David Bantz</div><div>U Alaska IAM</div></body></html>