<div dir="ltr">Found out my test webapp was sending requests directly to the idp server and getting load balanced to my production environment... <div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 19, 2021 at 10:38 PM Mohamed Lrhazi <<a href="mailto:lrhazi@cua.edu">lrhazi@cua.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<br><div><br></div><div>am using shibboleth <span style="background-color:rgb(253,246,227);color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap">4.0.1</span> and oidc 2.0.0</div><div><br></div><div>I have an RP configured and working fine, releasing many attributes. I needed to add an extra attribute but it would not work. While debugging, I tried to completely break it by messing up AttributeFilterPolicy as follows:</div><div><br></div><div><div style="line-height:18px"><br><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">    <<span style="color:rgb(38,139,210)">AttributeFilterPolicy</span> <span style="color:rgb(147,161,161)">id</span>=<span style="color:rgb(42,161,152)">"<a href="http://example.com" target="_blank">example.com</a>"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        <<span style="color:rgb(38,139,210)">PolicyRequirementRule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"AND"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">Rule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"Requester"</span> <span style="color:rgb(147,161,161)">value</span>=<span style="color:rgb(42,161,152)">"<a href="http://xexample.com" target="_blank">xexample.com</a>"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">Rule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"oidcext:OIDCScope"</span> <span style="color:rgb(147,161,161)">value</span>=<span style="color:rgb(42,161,152)">"xopenid"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        </<span style="color:rgb(38,139,210)">PolicyRequirementRule</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        <<span style="color:rgb(38,139,210)">AttributeRule</span> <span style="color:rgb(147,161,161)">attributeID</span>=<span style="color:rgb(42,161,152)">"subject"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">PermitValueRule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"ANY"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        </<span style="color:rgb(38,139,210)">AttributeRule</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        <<span style="color:rgb(38,139,210)">AttributeRule</span> <span style="color:rgb(147,161,161)">attributeID</span>=<span style="color:rgb(42,161,152)">"rokmetro_EMPLID"</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">            <<span style="color:rgb(38,139,210)">PermitValueRule</span> <span style="color:rgb(147,161,161)">xsi:type</span>=<span style="color:rgb(42,161,152)">"ANY"</span> /></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        </<span style="color:rgb(38,139,210)">AttributeRule</span>></div><div style="color:rgb(51,51,51);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(253,246,227)">        ...</div><br></div></div><div style="line-height:18px">I added an "x" to cause it to not match anymore.... but the clients still succeed in getting all the attributes as before! In the log I do see lines like this for all attributes:</div><div style="line-height:18px"><br></div><div style="line-height:18px"><font face="monospace"><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">DEBUG</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> [</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"><span><span><span><span><span><span><span>net</span>.<span>shibboleth</span></span>.<span>idp</span></span>.<span>attribute</span></span>.<span>filter</span></span>.<span>impl</span></span>.<span>AttributeFilterImpl</span></span>:<span>165</span></span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">] </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">-</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">Attribute</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">filtering</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">engine</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> '</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">ShibbolethAttributeFilter</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">'</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">:</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">no</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">policy</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">permitted</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">release</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">of</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">attribute</span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"><span>rokmetro</span>_<span style="background-color:rgb(254,242,215);border-top:4px solid rgb(254,242,215);border-bottom:4px solid rgb(254,242,215)"><span>EMPLID</span></span></span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap"> </span><span style="color:rgb(60,68,77);font-size:14px;white-space:pre-wrap">values</span><br></font></div><div style="line-height:18px"><font face="monospace">...</font></div><div style="line-height:18px"><br></div><div style="line-height:18px"><br></div><div style="line-height:18px">Why are attributes released despite these changes? </div><div style="line-height:18px"><br></div><div style="line-height:18px">Thanks,</div><div style="line-height:18px">Mohamed.</div><div style="line-height:18px"><br></div><div style="line-height:18px"><br></div><div style="line-height:18px"><br></div></div>
</blockquote></div>