<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
>I just happened to notice something in the log that combined with the use of External basically says that external code has a bug. What all that is about is beyond me, it's not our code.<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Sure. The Overt Shibboleth / Azure bridge is actually a Shibboleth SP that they've configured to carry out the Azure auth for the IDP. I've got a service call open with them so we'll see what they say. Basicall, authn requests come to the Shib IDP, it shunts
them off through the Overt SP, which does the call to Azure for the auth, Azure returns a yes / no, the SP sends it back to the IDP for token generation and handoff to the SP that the user was trying to log in to.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The concerning thing for me is that I don't see corresponding events in the SP log for the Bridge for these "broken" auth attempts - just in the IDP log.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
>If the only "broken" cases are when the Validate action logs that (null) string, that probably is the only underlying issue.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Yup, that's the case. It's only when there's that (null) string. Everything else works fine. Also this is happening across various SPs, but Zoom was just where we noticed it since we have Zoom set up to create accounts on login, and most of our SPs have pre-populated
user databases so these broken logins would just result in failure. In Zoom they create new accounts for the long alpanumeric string so they were easy to find and track.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'll see what Overt has to say once I'm in touch with their engineers.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks very much again for your help.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-Tim<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;">
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<span style="font-family: "Arial", "sans-serif"; color: black; font-size: 10pt;"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<b><span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a name="_MailAutoSig"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></b></a></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><b><span style="font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Tim Enders</span></b></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Senior Systems Engineer</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><img class="EmojiInsert" alt="1518788691975_Loyola.jpg" style="font-size:12pt" data-outlook-trace="F:1|T:1" src="cid:88f6cfc0-9479-4fbd-896a-0833dacb046e"><br>
</p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">4501 N. Charles Street</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Baltimore, MD 21210</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"><a href="mailto:tenders@loyola.edu">tenders@loyola.edu</a></span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Office- 410-617-2542</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">Fax - 410-617-6658</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);">www.loyola.edu</span></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><a href="http://www.twitter.com/LoyolaMaryland"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"></span></a><span style="font-size: 10pt; font-family: "Arial", sans-serif; color: rgb(31, 73, 125);"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(33, 33, 33);">
<a href="http://www.twitter.com/LoyolaMaryland" target="_blank"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"></span></a></p>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<p class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0pt">
<font face="Calibri"></font></p>
<div><font size="2" face="Tahoma"></font></div>
</div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size: 11pt;" data-ogsc="" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, September 1, 2020 4:43 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: IDP3 Occasionally failing to generate user attributes</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 9/1/20, 1:57 PM, "users on behalf of Timothy Enders" <users-bounces@shibboleth.net on behalf of tenders@loyola.edu> wrote:<br>
<br>
> These two auths both contain the long alphanumeric string that begins with "AAdzZWN" which is what Zoom ends up<br>
> using as the user ID of the new account it creates. I was assuming (forgive me because I don't know much about<br>
> NameID) that this was the transient NameID value that our IDP generated for that auth. Is that correct?<br>
<br>
That would be up to your logging configuration but I assume so. Values that long suggest you've configured it to produce cryptogprahically managed stateless transient IDs, which is certainly not required in most deployments, simple memory-backed GUIDs will
do. Still won't be anything Zoom can use. It's not getting something it expects obviously.<br>
<br>
If you want to block transactions that don't conform to an expected profile to avoid problems and trap errors before they reach Zoom, you can certainly do that, but it won't stop them, just catch them earlier.<br>
<br>
> And then it continues on like that. It seems like these "failures" are compressed into spats of a few minutes or so at a<br>
> time, spaced out over the day.<br>
<br>
I just happened to notice something in the log that combined with the use of External basically says that external code has a bug. What all that is about is beyond me, it's not our code.<br>
<br>
If it's still breaking Zoom even when the user identity is passed in fine, the resolver is still mis-configured in some other way and failing to produce whatever it's supposed to. If the only "broken" cases are when the Validate action logs that (null) string,
that probably is the only underlying issue.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7C1d191dbc63ad4887c22c08d84eb7c1c6%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C1%7C637345898420386814&sdata=O2x2bHiSfDp6DAo8K0i1qsJSot7u%2F4FBw%2BGBegMR0PE%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7C1d191dbc63ad4887c22c08d84eb7c1c6%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C1%7C637345898420386814&sdata=O2x2bHiSfDp6DAo8K0i1qsJSot7u%2F4FBw%2BGBegMR0PE%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>