<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">In the absence of better informed response, is the following a possible explanation?<div><br></div><div>Is is conceivable that the attribute FILTER removes ePA from the cached LDAP results because it has not been encoded? That seems odd, but would explain why the next trip through the resolver using the cache, the resolver finds 0 values.</div><div><br></div><div>(Why isn’t ePA encoded? My attribute resolver relies on ePA from our LDAP directory, and manipulates the values of ePA in the definition of a locally-defined attribute that has Member or Attribute added as appropriate to whatever values are in the LDAP directory. It’s that locally-defined attribute with augmented values that is with SAML name <u><font face="Monaco"><span style="font-size: 9px;">urn:oid:1.3.6.1.4.1.5923.1.1.1.1 </span></font></u>- that is, as ePA.)</div><div><br></div><div>David Bantz</div><div> </div><div><div><div>On Tue, 8 Jul 2014, at 16:53 , David Bantz <<a href="mailto:dabantz@Alaska.edu">dabantz@Alaska.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">A user with values of an attribute (ePA) in LDAP has the correct values retrieved and subsequently released the first time through, but on subsequent request, using cached values, logs indicate 0 values for the attribute when using the cache.<div><br></div><div>Has anyone a theory or a workaround (other than turning off the ResultsCache)?</div><div><br></div><div>David Bantz</div><div><br></div><div>Pertinent lines from the process log with key snippets underlined:</div><div><br></div><div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.009 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:354] - Resolving data connector myLDAP for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.010 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (|(uid=tabbey)(uasystemid=tabbey)(bannerid=tabbey))</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.010 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:344] - LDAP data connector myLDAP - Checking cache for search results</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.010 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:351] - LDAP data connector myLDAP - No results cached for search filter '(|(uid=tabbey)(uasystemid=tabbey)(bannerid=tabbey))'</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.010 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363] - <u>LDAP data connector myLDAP - Retrieving attributes from LDAP</u></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.087 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector myLDAP - Found the following attribute: uid[1XJWUFPD01]</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.087 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector myLDAP - <span style="text-decoration: underline">Found the following attribute: eduPersonAffiliation[Staff, Employee]</span></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.100 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonAffiliation for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonAffiliation containing 2 values</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.587 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonAffiliation containing 2 values</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.593 - DEBUG [edu.internet2.middleware.shibboleth.resolver.Script.scriptTest:-1] - ePA script; starting uakePA values: [Staff, Employee]</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.593 - DEBUG [edu.internet2.middleware.shibboleth.resolver.Script.scriptTest:-1] - ePA script: include Member; uakePA values: [Staff, Employee]</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.593 - DEBUG [edu.internet2.middleware.shibboleth.resolver.Script.scriptTest:-1] - ePA script non-S/E/S/F; uakePA values: [Staff, Employee]</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.594 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute uakeduPersonAffiliation containing 3 values</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.605 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:468] - Attribute eduPersonAffiliation has 2 values after post-processing</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.612 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:468] - Attribute uakeduPersonAffiliation has 3 values after post-processing</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.625 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute assignmentCount for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.625 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute creditHoursCurrent for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.625 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute bannerID for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.625 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute uakeduPersonAffiliation for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.625 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute displayname for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.625 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute email for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:32:23.655 - DEBUG [PROTOCOL_MESSAGE:74] - </div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;"><?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK">https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK</a>" ID="_8c0967b2083811931f91d1f120a35077" InResponseTo="_63CBB1656DB783793AAD850D9ACB726C" IssueInstant="2014-07-09T00:32:23.635Z" Version="2.0"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">…</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;"> <saml2:Attribute F<u>riendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></u></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string"><u>Member</u></saml2:AttributeValue></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string"><u>Staff</u></saml2:AttributeValue></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string"><u>Employee</u></saml2:AttributeValue></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;"> </saml2:Attribute></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">…</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px; position: static; z-index: auto;">Now using a different browser just a few seconds later:</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px; position: static; z-index: auto;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px; position: relative; z-index: 0;">16:33:02.797 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478] - Basing previous session authentication on active authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:Password16:33:02.797 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:467] - Authenticating user with previous session LoginHandler</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.797 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler:91] - MCBConfiguration bean = [edu.internet2.middleware.assurance.mcb.authn.provider.MCBConfiguration@15e3d24a]</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.798 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler:105] - Relying party = [<a href="https://demo.origamirisk.com/">https://demo.origamirisk.com</a>]</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.798 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler:121] - Using existing IdP session for tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 17px; font-size: 9px;"><br></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:119] - shibboleth.AttributeResolver resolving attributes for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal tabbey were not requested, resolving all attributes.</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute uid for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:354] - Resolving data connector myLDAP for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.812 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (|(uid=tabbey)(uasystemid=tabbey)(bannerid=tabbey))</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.812 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:344] - LDAP data connector myLDAP - Checking cache for search results</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.813 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:347] - <u>LDAP data connector myLDAP - Returning attributes from cache</u></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.813 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute uid containing 1 values</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 9px;">16:33:02.813 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonAffiliation for principal tabbey</div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto; font-size: 9px;">16:33:02.815 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - <u>Resolved attribute eduPersonAffiliation containing 0 values</u></div></div><div><br></div></div>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></body></html>