<div dir="ltr">While upgrading from IdPv 3.2.1 to 4.2.1, we encountered a difference in the way attributes are handled in the resulting SAML AttributeStatement.<div><br></div><div>For given AttributeDefinitions that happen to share the same Names, in 3.2 if we have an AttributeFilterPolicy that releases both attributes, they are released separately. However, in 4.2 with a similar AttributeFilterPolicy, the attributes appear to get merged. FWIW, the audit logs appear to show the release of the separate attributes even in 4.2 where the released AttributeStatement has merged the attributes.</div><div><br></div><div>I'm not sure if our original 3.2 configs were always "broken" and we were just lucky it "worked" (in a way we had come to rely on), or maybe we're doing it wrong in 4.2.</div><div><br></div><div>I've provided excerpts of our 3.2 and 4.2 AttributeDefinitions, resulting AttributeStatements, and audit logs associated with this behavior below using model attributes (attr_1, attr_2). The audit log field templates differ for the versions, but both sets should include the released attributes.</div><div><br></div><div>Are the 4.2 results we're observing expected and correct (we're presuming it's not a bug)? If necessary, it appears we can avoid this by using distinct Names for each of the attributes – which probably means working with the affected SPs to accommodate the change, but is there an alternate/better way to handle this?</div><div><br></div><div>3.2<br>###<br><br>attribute-resolver.xml:<br><br>    <!-- AttributeDefinition 1 --><br>    <resolver:AttributeDefinition xsi:type="ad:Simple"<br>            id="attr_1"<br>            sourceAttributeID="attr_1" ><br>        <resolver:Dependency ref="LDAP" /><br>        <resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>                name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                friendlyName="attr_1" /><br>    </resolver:AttributeDefinition><br><br>    <!-- AttributeDefinition 2 --><br>    <resolver:AttributeDefinition xsi:type="ad:Mapped"<br>            id="attr_2"<br>            sourceAttributeID="attr_1"><br>        <resolver:Dependency ref="LDAP" /><br>        <resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>                name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                friendlyName="attr_2" /><br>        <ad:ValueMap><br>            <ad:ReturnValue>BAR</ad:ReturnValue><br>            <ad:SourceValue ignoreCase="true">BAZ</ad:SourceValue><br>        </ad:ValueMap><br>    </resolver:AttributeDefinition><br><br>AttributeFilterPolicy results:<br><br>    <!-- AttributeFilterPolicy 1 - (release attr_1) --><br>    <saml2:AttributeStatement><br>      <saml2:Attribute FriendlyName="attr_1"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br>                              xsi:type="xsd:string">FOO</saml2:AttributeValue><br>      </saml2:Attribute><br>    </saml2:AttributeStatement><br><br>2022-06-30 14:04:26,091|20220701T000426Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_23ef84ccb6e0adc2f21f7b84589ae0fd|<a href="https://samltest.id/saml/sp%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp32.example.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_d51b26151a5006ea067649c785128872%7Cbaron%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7Cattr_1%7CAAdzZWNyZXQxsJHnmdyFeYtznAraXU17UOYRGfbtdh14bIQ5pqW/RCmBMHul+hcY7jt54EG+Sk2zpDcdv8fmsg7U0Wh5j7OFguN9We6ldZfkFbjlU9wIHbT4hF5g0D1XMOxBcUE=%7C_8bc550db007797b7b982964b4cea524e%7C%7C%7C10.10.10.10%7C" target="_blank">https://samltest.id/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp32.example.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_d51b26151a5006ea067649c785128872|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|attr_1|AAdzZWNyZXQxsJHnmdyFeYtznAraXU17UOYRGfbtdh14bIQ5pqW/RCmBMHul+hcY7jt54EG+Sk2zpDcdv8fmsg7U0Wh5j7OFguN9We6ldZfkFbjlU9wIHbT4hF5g0D1XMOxBcUE=|_8bc550db007797b7b982964b4cea524e|||10.10.10.10|</a><br><br>    <!-- AttributeFilterPolicy 2 - (release attr_2) --><br>    <saml2:AttributeStatement><br>      <saml2:Attribute FriendlyName="attr_2"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br>                              xsi:type="xsd:string">BAR</saml2:AttributeValue><br>      </saml2:Attribute><br>    </saml2:AttributeStatement><br><br>2022-06-30 14:10:26,950|20220701T001026Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_132f15e8634d7b2e0f38328212498391|<a href="https://samltest.id/saml/sp%7Chttp://shibboleth.net/ns/profiles/saml2/example/browser%7Chttps://idp32.example.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_bf4de8616a7f1a4aedddd8dd42506833%7Cbaron%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7Cattr_2%7CAAdzZWNyZXQxwT/OOqs305V2phU5qgPmb4qF5FghqGVhmbDrN/pxNbDZsQYaLHn8l7tVTX4rZQ/OF8MUmResPo57+qNZqCF7RWqc31pPocql6goiF7dpZ2TqdJqvNpdNDSMv160=%7C_2b9aceaa9fabb3bd68db8fb27e06ea3f%7C%7C%7C10.10.10.10%7C" target="_blank">https://samltest.id/saml/sp|http://shibboleth.net/ns/profiles/saml2/example/browser|https://idp32.example.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_bf4de8616a7f1a4aedddd8dd42506833|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|attr_2|AAdzZWNyZXQxwT/OOqs305V2phU5qgPmb4qF5FghqGVhmbDrN/pxNbDZsQYaLHn8l7tVTX4rZQ/OF8MUmResPo57+qNZqCF7RWqc31pPocql6goiF7dpZ2TqdJqvNpdNDSMv160=|_2b9aceaa9fabb3bd68db8fb27e06ea3f|||10.10.10.10|</a><br><br>    <!-- AttributeFilterPolicy 1+2 - (release attr_1, attr_2) --><br>    <saml2:AttributeStatement><br>        <saml2:Attribute FriendlyName="attr_1" Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>            <saml2:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema" target="_blank">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">FOO-grouping-init</saml2:AttributeValue><br>        </saml2:Attribute><br>        <saml2:Attribute FriendlyName="attr_2" Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>            <saml2:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema" target="_blank">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">BAR</saml2:AttributeValue><br>        </saml2:Attribute><br>    </saml2:AttributeStatement><br><br>    <saml2:AttributeStatement><br>      <saml2:Attribute FriendlyName="attr_1"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br>                              xsi:type="xsd:string">FOO</saml2:AttributeValue><br>      </saml2:Attribute><br>      <saml2:Attribute FriendlyName="attr_2"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br>                              xsi:type="xsd:string">BAR</saml2:AttributeValue><br>      </saml2:Attribute><br>    </saml2:AttributeStatement></div><div><br></div><div>*** Note attr_1 and attr_2 released as separate attributes with the Names from their respective AttributeDefinitions<br><br>2022-06-30 14:13:41,870|20220701T001341Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_f6d2231464cb43dcfaaed857ab523e87|<a href="https://samltest.id/saml/sp%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp32.example.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_04943c047dfec7bb037e79c166b2b0bb%7Cbaron%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7Cattr_1,attr_2%7CAAdzZWNyZXQxARArW6Ewjx/RNZVm/PGJrPM0bJ387ArgF8V9oM1Yd5WmHJM9yKe0EhbOniCfgil8ZaKTYcALHmbmFkgbQl8zTy/65ti4+Nr6oOt1D/NizKev9sTB1nk6xMq2L48=%7C_798eff004268eca113659fd4c4423c4c%7C%7C%7C10.10.10.10%7C" target="_blank">https://samltest.id/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp32.example.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_04943c047dfec7bb037e79c166b2b0bb|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|attr_1,attr_2|AAdzZWNyZXQxARArW6Ewjx/RNZVm/PGJrPM0bJ387ArgF8V9oM1Yd5WmHJM9yKe0EhbOniCfgil8ZaKTYcALHmbmFkgbQl8zTy/65ti4+Nr6oOt1D/NizKev9sTB1nk6xMq2L48=|_798eff004268eca113659fd4c4423c4c|||10.10.10.10|</a><br><br>4.2<br>###<br><br>attribute-resolver.xml:<br><br>    <!-- AttributeDefinition 1 --><br>    <AttributeDefinition id="attr_1" xsi:type="Simple"><br>        <InputDataConnector ref="LDAP" attributeNames="attr_1"/><br>        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999" friendlyName="attr_1" encodeType="false" /><br>    </AttributeDefinition><br><br>    <!-- AttributeDefinition 2 --><br>    <AttributeDefinition id="attr_2" xsi:type="Mapped"><br>        <InputDataConnector ref="LDAP" attributeNames="attr_1" /><br>        <DefaultValue passThru="false"/><br>        <ValueMap><br>            <ReturnValue>BAR</ReturnValue><br>            <SourceValue caseSensitive="true">BAZ</SourceValue><br>        </ValueMap><br>        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999" friendlyName="attr_2" /><br>     </AttributeDefinition><br><br>AttributeFilterPolicy results:<br>    <!-- AttributeFilterPolicy 1 - (release attr_1) --><br>    <saml2:AttributeStatement><br>      <saml2:Attribute FriendlyName="attr_1"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue>FOO</saml2:AttributeValue><br>      </saml2:Attribute><br>    </saml2:AttributeStatement><br><br>2022-06-30 14:20:45.730-1000|2022-06-30 14:20:11.881-1000|10.17.133.34|baron|<a href="https://samltest.id/saml/sp%7C_09f74daf40351ffa693fa611db3f0c75%7Cpassword%7C2022-06-30" target="_blank">https://samltest.id/saml/sp|_09f74daf40351ffa693fa611db3f0c75|password|2022-06-30</a> 14:20:45.579-1000|attr_1|||false|false||Redirect|POST||Success|||Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<a href="http://102.0.0.0" target="_blank">102.0.0.0</a> Safari/537.36<br><br>    <!-- AttributeFilterPolicy 2 - (release attr_2) --><br>    <saml2:AttributeStatement><br>      <saml2:Attribute FriendlyName="attr_2"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue>BAR</saml2:AttributeValue><br>      </saml2:Attribute><br>    </saml2:AttributeStatement><br><br>2022-06-30 14:24:55.783-1000|2022-06-30 14:24:38.863-1000|10.17.133.34|baron|<a href="https://samltest.id/saml/sp%7C_6402066046dcdf0373d8b4e0d6a4595d%7Cpassword%7C2022-06-30" target="_blank">https://samltest.id/saml/sp|_6402066046dcdf0373d8b4e0d6a4595d|password|2022-06-30</a> 14:24:55.669-1000|attr_2|||false|false||Redirect|POST||Success|||Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<a href="http://102.0.0.0" target="_blank">102.0.0.0</a> Safari/537.36<br><br>    <!-- AttributeFilterPolicy 1+2 - (release attr_1, attr_2) --><br>    <saml2:AttributeStatement><br>      <saml2:Attribute FriendlyName="attr_1"<br>                       Name="urn:oid:1.3.6.1.4.1.2160.1.1.1.9999"<br>                       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml2:AttributeValue>FOO-test-1</saml2:AttributeValue><br>        <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br>                              xsi:type="xsd:string">BAR</saml2:AttributeValue><br>      </saml2:Attribute><br>    </saml2:AttributeStatement></div><div><br></div><div>*** Note attr_1 and attr_2 apparently merged into attr_1<br><br>2022-06-30 14:27:16.522-1000|2022-06-30 14:27:01.206-1000|10.17.133.34|baron|<a href="https://samltest.id/saml/sp%7C_78d37f58dd1627d0ecce8d7daa2dffe0%7Cpassword%7C2022-06-30" target="_blank">https://samltest.id/saml/sp|_78d37f58dd1627d0ecce8d7daa2dffe0|password|2022-06-30</a> 14:27:16.406-1000|attr_1,attr_2|||false|false||Redirect|POST||Success|||Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<a href="http://102.0.0.0" target="_blank">102.0.0.0</a> Safari/537.36<br clear="all"><div><br></div>-- <br><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><font face="arial, sans-serif">Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> ::: UH Information Technology Services<br>minutas cantorum, minutas balorum, minutas carboratum descendus pantorum</font></div></div></div></div>