<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thanks again, Scott.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
For the record, here's a successful "normal" auth that directly preceeded that one:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
2020-08-31 07:36:49,495 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:147] - Profile Action ValidateExternalAuthentication: External authentication succeeded for user: cadavidson</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
2020-08-31 07:36:49,542 - INFO [Shibboleth-Audit.SSO:275] - 20200831T113649Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|a3cf1e078fb9gaba-4cecghej450b9h7|https://loyola.zoom.us|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8246c63fffc15a5a7843db5858246787|cadavidson|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|commonName,loyIsFaculty,eduPersonAffiliation,displayName,givenName,loyPrtlConst,loyolaID,eduPersonScopedAffiliation,loyCampusHousing,surname,loyZoomHIPAA,eduPersonPrincipalName,email|AAdzZWNyZXQxo5gPYOQH/gTsiXPV0DLKO9K592kOoqZvuAV+5Pm9/dYYIGKfreW2xxA2n/uHXPrwaVIPjZ1k6e+4aGEOIzofEdvC1mvqrYUy+YT5sP0IqWkARJ2A/cT2ViJYq3SxYEw=|_d3940f93885c60902391b1f49487b8e7|<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
These two auths both contain the long alphanumeric string that begins with "AAdzZWN" which is what Zoom ends up using as the user ID of the new account it creates. I was assuming (forgive me because I don't know much about NameID) that this was the transient
NameID value that our IDP generated for that auth. Is that correct?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
The only interesting things I see in the transaction log for the Bridge SP is that there don't appear to be entries *at all* for these "failed" logins. If I compare the T-log from the SP with the IDP process log, see:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<ul>
<li>Corresponding events for five or six "normal" user logins in a row</li><li>Then, in the IDP process log there are 82 of these "failed" logins in a row, all compressed into the next minute or so, all of which have NO corresponding event in the SP log for the bridge</li><li>Then there is one "normal" user login that has a corresponding entry in the SP log</li><li>Then in the IDP process log there are 132 of the "failed" logins in a row, over the space of the next minute or two, all of which have NO corresponding event in the SP log for the bridge.</li><li>Then there's another "normal" login that has a corresponding entry in the SP log</li></ul>
<div>And then it continues on like that. It seems like these "failures" are compressed into spats of a few minutes or so at a time, spaced out over the day.</div>
<div><br>
</div>
<div>Sorry about the brain dump, I'm collecting my own thoughts as much as I'm asking a question here, I suppose.<br>
</div>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I really appreciate your help - I know you spend a TON of time answering questions like this that are probably actually very basic.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;">
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<span style="font-family: "Arial", "sans-serif"; color: black; font-size: 10pt;"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<b><span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a name="_MailAutoSig"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></b></a></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Tim Enders</span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Senior Systems Engineer</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><img class="EmojiInsert" alt="1518788691975_Loyola.jpg" style="font-size:12pt" data-outlook-trace="F:1|T:1" src="cid:9aa1c08e-ccb7-4afd-9249-c8f14f01d698"><br>
</p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">4501 N. Charles Street</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Baltimore, MD 21210</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"><a href="mailto:tenders@loyola.edu">tenders@loyola.edu</a></span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Office- 410-617-2542</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Fax - 410-617-6658</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">www.loyola.edu</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a href="http://www.twitter.com/LoyolaMaryland"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></a><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<a href="http://www.twitter.com/LoyolaMaryland" target="_blank"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"></span></a></p>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<font face="Calibri"></font></p>
<div><font size="2" face="Tahoma"></font></div>
</div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size: 11pt;" data-ogsc="" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, September 1, 2020 12:44 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: IDP3 Occasionally failing to generate user attributes</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 9/1/20, 12:39 PM, "users on behalf of Timothy Enders" <users-bounces@shibboleth.net on behalf of tenders@loyola.edu> wrote:<br>
<br>
> These (at least some of the ones I've checked) do appear to be actual users who did have a successful auth through<br>
> Azure. In that case, is this somehow still Azure returning a "null" value (that's actually that string) every so often when<br>
> someone logs in?<br>
<br>
I can't see any other explanation when the log line immediately follows an explicit null check for the field being logged.<br>
<br>
> I assume that the further error about the Attribute Definition script not running correctly is maybe caused by the fact<br>
> that the IDP can't look up the user in LDAP at all, instead of a communication issue with LDAP. Does that make any<br>
> sense?<br>
<br>
And the fact your LDAP lookup is programmed to treat no results as success, causing another script to run that's probably sourcing data from a resolved attribute with no values.<br>
<br>
The whole resolver stack is implicated.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7C6e907dad0004487ad1f208d84e964081%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C637345754521169193&sdata=iShsEVg8H5vKZw9MWjfGKb9FR5DFqAwYDxcaWti1n4g%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7C6e907dad0004487ad1f208d84e964081%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C637345754521169193&sdata=iShsEVg8H5vKZw9MWjfGKb9FR5DFqAwYDxcaWti1n4g%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>