<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi everyone:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Forgive the novel I am about to write, but I have an oddball situation that I could really use some extra eyes on.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
We have an implementation of IDP v3 that we use as part of our enterprise SSO architecture. When a user signs in to a Shibboleth protected resource, the IDP uses a bridge to do authentication against Azure, and then uses an LDAP connection (round robin to our
on-prem AD DCs) to do attribute generation after a successful auth.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
We have been having an issue lately where when a user signs in to Zoom (one of the apps that uses Shibboleth), instead of signing the user into their own Zoom account, it will create them a new account with a gibberish name and sign them in to that. Normally,
Zoom should be looking at the Employee ID number attribute (and failing back to the email address attribute if that one's missing) that we send to either match the user to an existing Zoom account or create a new one for them. Instead, it appears that sometimes
Zoom is creating accounts for people based of the SAML NameID, which Shibboleth is sending as a Transient (randomly generated value). When I look at the Zoom SAML logs for these instances, Zoom has received a valid SAML token that contains no attributes and
has a Transient NameID and so it has created an account with that NameID for the name.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
This seems to happen in spats of a ton of instances all at once. For example, in one minute yesterday (8/31/20, 07:36) there were 90 of these accounts created. In each instance where this happens, if I look at the IDP Process log on the IDP server, there's
an entry like this:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
----------</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
2020-08-31 07:36:57,854 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:147] - Profile Action ValidateExternalAuthentication: External authentication succeeded for user: (null)
<div>2020-08-31 07:36:57,886 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:314] - Profile Action ResolveAttributes: Error resolving attributes</div>
<div>net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'institutionID':Script did not run successfully</div>
<div>at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition$AttributeDefinitionScriptEvaluator.execute(ScriptedAttributeDefinition.java:228)</div>
<div>Caused by: java.lang.IndexOutOfBoundsException: Index: 0, Size: 0</div>
<div>at java.util.ArrayList.rangeCheck(ArrayList.java:657)</div>
2020-08-31 07:36:57,901 - INFO [Shibboleth-Audit.SSO:275] - 20200831T113657Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|a-327a26fb10e0f0a-3g842hg5b15a9bi|https://loyola.zoom.us|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_6b04475da047ed6ca73babbc6d4d9f8b|(null)|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxvGzllP1nvqweGpg/pLsjKC3cldHFGs2LanhcDqIUorKf/caErkJ8/fdJxp1fupq+FHcYPzbSdPxqdrAYUcf1FHywL6/N/3GG19VOGrdSY8Id4fh2cUAZEHoFhQ==|_cfb376e0414280e14de0d9d4a2d36729|</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
----------</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
It looks to me from this log that the IDP may be having difficulty making the LDAPS connection to the DC to read the user's attributes after a successful auth, and then is building an auth token without any attributes and sending it. Does that sound right?
I don't know enough about the Shibboleth specific error messages to know what it means when it gives the line about:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Attribute Definition 'institutionID':Script did not run successfully<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
But it seems that it's caused when the IDP can't read the LDAP attributes for the logged in user.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I *think* that I need to go track down why the IDP is failing it's check of the LDAP every so often, but I wanted to run it by the list to see if anyone has seen anything similar in the past, or has any ideas. There doesn't seem to be any consistency as to
when it does this vs working properly - there will be a large spate of failures like this over the course of a minute or two, and then things will go right back to normal, it reads attributes and generates the tokens normally, and users log in successfully.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thoughts?<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thank you!</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
-Tim<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;">
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<span style="font-family: "Arial", "sans-serif"; color: black; font-size: 10pt;"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<b><span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a name="_MailAutoSig"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></b></a></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Tim Enders</span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Senior Systems Engineer</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><img class="EmojiInsert" alt="1518788691975_Loyola.jpg" style="font-size:12pt" data-outlook-trace="F:1|T:1" src="cid:a1c483a5-6d34-410f-97d4-66cd63e8edeb"><br>
</p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">4501 N. Charles Street</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Baltimore, MD 21210</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"><a href="mailto:tenders@loyola.edu">tenders@loyola.edu</a></span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Office- 410-617-2542</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Fax - 410-617-6658</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">www.loyola.edu</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a href="http://www.twitter.com/LoyolaMaryland"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></a><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<a href="http://www.twitter.com/LoyolaMaryland" target="_blank"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"></span></a></p>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<font face="Calibri"></font></p>
<div><font size="2" face="Tahoma"></font></div>
</div>
</div>
</div>
</div>
</body>
</html>