<div dir="ltr">Hello,<br><div><br></div><div>am using shibboleth <span style="background-color:rgb(253,246,227);color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre">4.0.1</span> and oidc 2.0.0</div><div><br></div><div>I have an RP configured and working fine, releasing many attributes. I needed to add an extra attribute but it would not work. While debugging, I tried to completely break it by messing up AttributeFilterPolicy as follows:</div><div><br></div><div><div style="line-height:18px"><br><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">    <<span style="color:rgb(38,139,210)">AttributeFilterPolicy</span> <span style="color:rgb(147,161,161)">id</span>=<span style="color:rgb(42,161,152)">"<a href="http://example.com" target="_blank">example.com</a>"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        <<span style="color:rgb(38,139,210)">PolicyRequirementRule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"AND"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">Rule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"Requester"</span> <span style="color:rgb(147,161,161)">value</span>=<span style="color:rgb(42,161,152)">"<a href="http://xexample.com" target="_blank">xexample.com</a>"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">Rule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"oidcext:OIDCScope"</span> <span style="color:rgb(147,161,161)">value</span>=<span style="color:rgb(42,161,152)">"xopenid"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        </<span style="color:rgb(38,139,210)">PolicyRequirementRule</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        <<span style="color:rgb(38,139,210)">AttributeRule</span> <span style="color:rgb(147,161,161)">attributeID</span>=<span style="color:rgb(42,161,152)">"subject"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">PermitValueRule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"ANY"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        </<span style="color:rgb(38,139,210)">AttributeRule</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        <<span style="color:rgb(38,139,210)">AttributeRule</span> <span style="color:rgb(147,161,161)">attributeID</span>=<span style="color:rgb(42,161,152)">"rokmetro_EMPLID"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">PermitValueRule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"ANY"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        </<span style="color:rgb(38,139,210)">AttributeRule</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        ...</div><br></div></div><div style="line-height:18px">I added an "x" to cause it to not match anymore.... but the clients still succeed in getting all the attributes as before! In the log I do see lines like this for all attributes:</div><div style="line-height:18px"><br></div><div style="line-height:18px"><font face="monospace"><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">DEBUG</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> [</span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t"><span class="gmail-t">net</span>.<span class="gmail-t">shibboleth</span></span>.<span class="gmail-t">idp</span></span>.<span class="gmail-t">attribute</span></span>.<span class="gmail-t">filter</span></span>.<span class="gmail-t">impl</span></span>.<span class="gmail-t">AttributeFilterImpl</span></span>:<span class="gmail-t">165</span></span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">] </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">-</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">Attribute</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">filtering</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">engine</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> '</span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">ShibbolethAttributeFilter</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">'</span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">:</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">no</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">policy</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">permitted</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">release</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">of</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">attribute</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"><span class="gmail-t">rokmetro</span>_<span class="gmail-t gmail-a" style="background-color:rgb(254,242,215);border-top:4px solid rgb(254,242,215);border-bottom:4px solid rgb(254,242,215)"><span class="gmail-t">EMPLID</span></span></span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span class="gmail-t" style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">values</span><br></font></div><div style="line-height:18px"><font face="monospace">...</font></div><div style="line-height:18px"><br></div><div style="line-height:18px"><br></div><div style="line-height:18px">Why are attributes released despite these changes? </div><div style="line-height:18px"><br></div><div style="line-height:18px">Thanks,</div><div style="line-height:18px">Mohamed.</div><div style="line-height:18px"><br></div><div style="line-height:18px"><br></div><div style="line-height:18px"><br></div></div>