<div dir="ltr"><div>An issue has cropped up in our dev environment where certain attributes are being asserted twice in outgoing SAML assertions.  The debug logs seem to indicate that the attributes in question are resolving with the expected values and go through deduplication as one would expect.<br></div><div><br></div><div>However, the outgoing SAML assertion is logged and sent with certain attributes having duplicate entries.  It seems to be the same attributes each time.  </div><div><br></div><div>example:</div><div><br></div><div><font face="monospace"><?xml version="1.0" encoding="UTF-8"?><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_072e286791964ec69c0c9372562be01e" IssueInstant="2021-02-19T21:46:14.418Z" Version="2.0"><br>    <saml2:Issuer><a href="https://idp-dev.uncg.edu/idp/shibboleth">https://idp-dev.uncg.edu/idp/shibboleth</a></saml2:Issuer><br>    <saml2:Subject><br>        <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp-dev.uncg.edu/idp/shibboleth">https://idp-dev.uncg.edu/idp/shibboleth</a>" SPNameQualifier="<a href="https://grouper-dev.uncg.edu/shibboleth">https://grouper-dev.uncg.edu/shibboleth</a>">AAdzZWNyZXQx34D2/aUC9R0pNqQn1nhI08v17fteNQ3RdeVYCJ+ApE6Aay+v7nJBWnBl8OHUXpiNwc038I3el2iKAp6mgpkVGKb3hYZcMjCmH7AYr4CwC764OJ8g9kz1ZfI7sHhvc9XY1+7UVUmjK+MyNmyKYa0=</saml2:NameID><br>        <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br>            <saml2:SubjectConfirmationData Address="10.80.212.191" InResponseTo="_3423a6a3d43cb1aab0d46e62b785029b" NotOnOrAfter="2021-02-19T21:51:14.472Z" Recipient="<a href="https://grouper-dev.uncg.edu/Shibboleth.sso/SAML2/POST">https://grouper-dev.uncg.edu/Shibboleth.sso/SAML2/POST</a>"/><br>        </saml2:SubjectConfirmation><br>    </saml2:Subject><br>    <saml2:Conditions NotBefore="2021-02-19T21:46:14.418Z" NotOnOrAfter="2021-02-19T21:51:14.418Z"><br>        <saml2:AudienceRestriction><br>            <saml2:Audience><a href="https://grouper-dev.uncg.edu/shibboleth">https://grouper-dev.uncg.edu/shibboleth</a></saml2:Audience><br>        </saml2:AudienceRestriction><br>    </saml2:Conditions><br>    <saml2:AuthnStatement AuthnInstant="2021-02-19T21:46:13.559Z" SessionIndex="_cba6ccf7163e4d1f47be3fc0b553cf7d"><br>        <saml2:SubjectLocality Address="10.80.212.191"/><br>        <saml2:AuthnContext><br>            <saml2:AuthnContextClassRef><a href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a></saml2:AuthnContextClassRef><br>        </saml2:AuthnContext><br>    </saml2:AuthnStatement><br>    <saml2:AttributeStatement><br>        <saml2:Attribute FriendlyName="uidNumber" Name="urn:oid:1.3.6.1.1.1.1.0" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>            <saml2:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">080808</saml2:AttributeValue><br>        </saml2:Attribute><br>        <saml2:Attribute FriendlyName="cn" Name="urn:oid:2.5.4.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>            <saml2:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">JFWILLIA</saml2:AttributeValue><br>        </saml2:Attribute><br>        <saml2:Attribute FriendlyName="cn" Name="urn:oid:2.5.4.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>            <saml2:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">JFWILLIA</saml2:AttributeValue><br>        </saml2:Attribute><br>    </saml2:AttributeStatement><br></saml2:Assertion></font><br></div><div><br></div><div>Since I'm not 100% on when the issue began, I've been backing out changes for a while to see if it stops.  No such luck yet.  Does anyone have any suggestions about where to look in order to determine what would be causing such behavior?</div><div><br></div><div>Thanks!</div><div><br><div><br></div>-- <br><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Jeffrey Williams </div><div dir="ltr">Identity & Access Engineer<br>Identity & Access Services<br><a href="https://its.uncg.edu" target="_blank">https://its.uncg.edu</a></div></div><div dir="ltr"><br></div><div dir="ltr"><img src="https://uncgcdn.blob.core.windows.net/email/UNCGLogo.png"><br></div></div></div></div></div></div></div></div></div></div></div>