<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Scott:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thanks SO much.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
For the record, we are using the Overt Software Shibboleth Bridge product for this. It's basically a separate SP that does the Azure (or ADFS, in the past) part of the process for us. I'll check in the SP logs for that, and then with Overt and see if they can
be of help if I can't get anywhere on my own.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
However:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
These (at least some of the ones I've checked) do appear to be actual users who did have a successful auth through Azure. In that case, is this somehow still Azure returning a "null" value (that's actually that string) every so often when someone logs in?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I assume that the further error about the Attribute Definition script not running correctly is maybe caused by the fact that the IDP can't look up the user in LDAP at all, instead of a communication issue with LDAP. Does that make any sense?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thanks again for your help.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;">
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<span style="font-family: "Arial", "sans-serif"; color: black; font-size: 10pt;"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<b><span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a name="_MailAutoSig"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></b></a></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Tim Enders</span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Senior Systems Engineer</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><img class="EmojiInsert" alt="1518788691975_Loyola.jpg" style="font-size:12pt" data-outlook-trace="F:1|T:1" src="cid:6b96323c-b035-4130-a89b-667ebb13c6ba"><br>
</p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">4501 N. Charles Street</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Baltimore, MD 21210</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"><a href="mailto:tenders@loyola.edu">tenders@loyola.edu</a></span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Office- 410-617-2542</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Fax - 410-617-6658</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">www.loyola.edu</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a href="http://www.twitter.com/LoyolaMaryland"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></a><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<a href="http://www.twitter.com/LoyolaMaryland" target="_blank"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"></span></a></p>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<font face="Calibri"></font></p>
<div><font size="2" face="Tahoma"></font></div>
</div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size: 11pt;" data-ogsc="" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, September 1, 2020 11:22 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: IDP3 Occasionally failing to generate user attributes</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">a) Your authentication implementation is broken and is returning some kind of string value of "(null)" or some such instead of signaling failure. You can't possibly have that kind of log output without it doing something very, very wrong
in the External bridge code.<br>
<br>
The code absolutely checks for null there, which means the value isn't in fact null, it's actually got to be that string. That should never happen.<br>
<br>
b) Your attribute logic is reacting to errors (or suppressing them) in such a way as to allow the absence of any information to be successful and not raise fatal errors, and having done that, you are deciding that issuing empty assertions is an acceptable outcome.<br>
<br>
There are error handling options all over the system to influence all of that.<br>
<br>
(a) is honestly of much greater concern. There's no way that should be happening and that isn't the IdP doing that, it's the other side of that callout.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7C1ad8257f9dd64cb1b09508d84e8b4742%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C637345707400837424&sdata=jM2I6Szo5BgKSQAKeHACeRf3%2Bs7hzNPzcvm%2BCvW6Edw%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7C1ad8257f9dd64cb1b09508d84e8b4742%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C637345707400837424&sdata=jM2I6Szo5BgKSQAKeHACeRf3%2Bs7hzNPzcvm%2BCvW6Edw%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>