<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Microsoft Theme 2.00" content="Arctic 111">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Verdana",sans-serif;
color:#4864A7;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#CE3345;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-ligatures:none;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;
mso-ligatures:none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" background="cid:image003.gif@01DA3CFB.3765B080" lang="EN-US" link="#CE3345" vlink="#A43ACE" style="word-wrap:break-word">
<img src="cid:image003.gif@01DA3CFB.3765B080" v:src="cid:image003.gif@01DA3CFB.3765B080" v:shapes="_x0000_Mail" width="0" height="0" class="shape" style="display:none;width:0;height:0"><!--[if gte mso 9]><xml>
<v:background id="_x0000_s1025" o:bwmode="white" o:targetscreensize="1024,768">
<v:fill src="cid:image003.gif@01DA3CFB.3765B080" o:title="background_arctic" type="frame" />
</v:background></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-ligatures:none">Two typos fixed (the version number should have been 3.4.1, and the more restrictive regex began with `^.*`--this is fixed below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-ligatures:none">All of the behavior is as described and reproducible. I apologize for the previous email. -F<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-ligatures:none"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext;mso-ligatures:none">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext;mso-ligatures:none"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Florian Lengyel via users<br>
<b>Sent:</b> Monday, January 1, 2024 9:32 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Cc:</b> Florian Lengyel <Florian.Lengyel@cuny.edu><br>
<b>Subject:</b> Unexpected reproducible behavior of PermitValue rule of type ScopeRegex in Shibboleth SP 3.4.1<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid windowtext 1.0pt;padding:0in 0in 0in 0in;margin-left:24.0pt;margin-top:24.0pt;margin-right:24.0pt;margin-bottom:24.0pt">
<p align="center" style="text-align:center;background:#FFFCD5"><b><span style="color:black">* This email originates from a sender outside of CUNY. Verify the sender before replying or clicking on links and attachments. *</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#98AFF3">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">I’ve installed Shibboleth SP 3.4.</span><span style="color:#1F497D">1</span><span style="color:#98AFF3"> by RPM on two Red Hat 7.9 Linux systems.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">Their purpose is to test Token Issuance Policies in Oracle Access Manager (OAM) 12.c.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">Here OAM functions as the IdP. The service provider is not a production system.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The SP has a relatively trivial `shibboleth-policy.xml`. A minor change to the regex of an
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">AttributeRule of type `ScopeRegex` for `eppn` will lead the SP to skip an `eppn` value
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">that matches a more restrictive regex. This is reproducible behavior.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span style="color:#98AFF3">[I have made some one-for-one substitutions in the output to discourage spamming.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="color:#98AFF3">For example, “CUNY” became “PUNY” for “Public University of New York.”]<o:p></o:p></span></i></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">Here is the complete `shibboleth-policy.xml` with the more permissive regex that fails:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <AttributeFilterPolicy id="AllowEppnOnly"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <PolicyRequirementRule xsi:type="basic:ANY"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </span><span lang="FR" style="color:#98AFF3"><AttributeRule attributeID="eppn"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> <PermitValueRule xsi:type="ScopeRegex" regex="^.*\.edu$" /><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> </span><span style="color:#98AFF3"></AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <AttributeFilterPolicy id="AllowAll"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <PolicyRequirementRule xsi:type="basic:ANY"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <AttributeRule attributeID="*"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <PermitValueRule xsi:type="basic:ANY"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The rule itself is permissive—this is for a test system. Also, the unexpected behavior documented below<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">led me to relax the attribute policy—the purpose was to run performance tests of an IdP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The log file `/var/log/shibboleth/shibd.log` shows<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">2024-01-01 20:36:00 WARN Shibboleth.AttributeFilter [2] [default]: removed value at position (0) of attribute (eppn) from (<a href="https://ssoyellow.cuny.edu/oam/fed">https://idp.puny.edu/oam/fed</a>)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">2024-01-01 20:36:00 WARN Shibboleth.AttributeFilter [2] [default]: no values left, removing attribute (eppn) from (<a href="https://ssoyellow.cuny.edu/oam/fed">https://idp.puny.edu/oam/fed</a>)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The `eppn` value is in the SAML response, but not in the SP environment. The attribute-map.xml file has the mapping<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> id="eppn"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"></Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">SAML response:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Subject><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NameQualifier="<a href="https://urldefense.com/v3/__https://idp.puny.edu/oam/fed*22__;JQ!!PxiZbSOawA!P29s7Qe2XCONalok-NfccoUYBYkekIYO6xC1aBRM6BOk4TmHr7fewaV6NkfQ788WndJoOVQlTn9CEKTHM1zeeA83$">https://idp.puny.edu/oam/fed"</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> SPNameQualifier="<a href="https://urldefense.com/v3/__https://fedsso.puny.edu/sp/shibboleth*22__;JQ!!PxiZbSOawA!P29s7Qe2XCONalok-NfccoUYBYkekIYO6xC1aBRM6BOk4TmHr7fewaV6NkfQ788WndJoOVQlTn9CEKTHM5CjInXp$">https://fedsso.puny.edu/sp/shibboleth"</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> >49865801</saml:NameID><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:SubjectConfirmationData InResponseTo="_71f4fc027c7bbe6e6661b0800ebb0e8b"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NotOnOrAfter="2024-01-02T01:41:00Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> Recipient="<a href="https://urldefense.com/v3/__https://fedsso.puny.edu/Shibboleth.sso/SAML2/POST*22__;JQ!!PxiZbSOawA!P29s7Qe2XCONalok-NfccoUYBYkekIYO6xC1aBRM6BOk4TmHr7fewaV6NkfQ788WndJoOVQlTn9CEKTHM1PyC8lt$">https://fedsso.puny.edu/Shibboleth.sso/SAML2/POST"</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:SubjectConfirmation><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:Subject><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Conditions NotBefore="2024-01-02T01:36:00Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NotOnOrAfter="2024-01-02T01:41:00Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AudienceRestriction><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Audience><a href="https://fedsso.puny.edu/sp/shibboleth%3c/saml:Audience">https://fedsso.puny.edu/sp/shibboleth</saml:Audience</a>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </span><span lang="FR" style="color:#98AFF3"></saml:AudienceRestriction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> </saml:Conditions><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> <saml:AuthnStatement AuthnInstant="2024-01-02T01:36:00Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> SessionIndex="id-EmSaXYobUIwbl1canasS78gkkL0aGK2mQTD2N7MB"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> SessionNotOnOrAfter="2024-01-02T02:36:00Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> <saml:AuthnContext><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> </saml:AuthnContext><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="color:#98AFF3"> </span><span style="color:#98AFF3"></saml:AuthnStatement><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AttributeStatement><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> xsi:type="xsd:string"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> >49865801</saml:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Attribute Name="urn:oid:2.16.840.1.113730.3.1.241"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> xsi:type="xsd:string"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> >Florian Lengyel</saml:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Attribute Name="<b>urn:oid:1.3.6.1.4.1.5923.1.1.1.6</b>"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> xsi:type="xsd:string"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><a href="mailto:FLORIAN.LENGYEL94@login.puny.edu%3c/saml:AttributeValue">FLORIAN.LENGYEL94@login.puny.edu</saml:AttributeValue</a>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Attribute Name="urn:oid:2.5.4.42"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> xsi:type="xsd:string"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> >Florian</saml:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:Attribute Name="urn:oid:2.5.4.4"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <saml:AttributeValue xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> xsi:type="xsd:string"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> >Lengyel</saml:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </saml:AttributeStatement><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The eppn value does not appear in the Session:<o:p></o:p></span></p>
<p class="MsoNormal"><u><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"><o:p><span style="text-decoration:none"> </span></o:p></span></u></p>
<p class="MsoNormal"><u><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Miscellaneous</span></u><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Session Expiration (barring inactivity):</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">
40 minute(s)<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Client Address:</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"> 172.27.9.84<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">SSO Protocol:</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"> urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Identity Provider:</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">
<a href="https://ssoyellow.cuny.edu/oam/fed">https://idp.puny.edu/oam/fed</a><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Authentication Time:</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"> 2024-01-02T01:36:00Z<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Authentication Context Class:</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Authentication Context Decl:</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"> (none)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"><u><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">Attributes</span></u><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">displayName</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">: Florian Lengyel<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">givenName</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">: Florian<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">persistent-id</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">: 49865801<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">sn</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">: Lengyel<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">uid</span></b><span style="font-size:10.0pt;font-family:"Courier New";color:windowtext;mso-ligatures:none">: 49865801<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">Now let’s send the same SAML attribute statement (the SAML response is identical, up to ID, etc.,)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">after replacing the regex in the` AllowEppnOnly` AttributeRule above in `attribute-policy.xml` with a more
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">restrictive regex, as in <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <AttributeFilterPolicy id="AllowEppnOnly"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <PolicyRequirementRule xsi:type="basic:ANY"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <AttributeRule attributeID="eppn"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> <PermitValueRule xsi:type="ScopeRegex" regex="^</span><span style="color:#1F497D">.*</span><span style="color:#98AFF3">login\.puny\.edu$" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"> </AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">We restart the server, log in as before but this time, the `eppn` value is present!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">Now the eppn value is present in the environment—here is a portion of the environment.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Shib_Session_Inactivity: 1704165205<br>
Shib_Session_Index: id-EmSaXYobUIwbl1canasS78gkkL0aGK2mQTD2N7MB<br>
UNIQUE_ID: ZZNxRfz9D8uZRIUA5dRm9wAAAAA<br>
displayName: Florian Lengyel<br>
eppn: <a href="mailto:FLORIAN.LENGYEL94@login.cuny.edu">FLORIAN.LENGYEL94@login.puny.edu</a><br>
givenName: Florian<br>
persistent_id: 49865801<br>
sn: Lengyel<br>
uid: 49865801<span style="color:#98AFF3"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The `/var/log/shibboleth/shibd.log` does not show any attributes that were skipped.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">tc/shibboleth/sp-encrypt-cert.pem)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">2024-01-01 21:12:21 INFO Shibboleth.Listener : listener service starting<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">2024-01-01 21:12:44 INFO Shibboleth.SessionCache [2] [default]: new session created: ID (_81541e7f04de639945ceaf5848c5d739) IdP (<a href="https://ssoyellow.cuny.edu/oam/fed">https://ssoyellow.cuny.edu/oam/fed</a>)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (172.27.9.84)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">The `Shibboleth.sso/Session` endpoint shows the same mapped attributes.<o:p></o:p></span></p>
<pre><u><o:p><span style="text-decoration:none"> </span></o:p></u></pre>
<pre><u>Miscellaneous</u><o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">Session Expiration (barring inactivity):</span></strong> 57 minute(s)<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">Client Address:</span></strong> 172.27.9.84<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">SSO Protocol:</span></strong> urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">Identity Provider:</span></strong> <a href="https://ssoyellow.cuny.edu/oam/fed">https://idp.puny.edu/oam/fed</a><o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">Authentication Time:</span></strong> 2024-01-02T01:36:00Z<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">Authentication Context Class:</span></strong> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">Authentication Context Decl:</span></strong> (none)<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><u>Attributes</u><o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">displayName</span></strong>: Florian Lengyel<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">eppn</span></strong>: <a href="mailto:FLORIAN.LENGYEL94@login.cuny.edu">FLORIAN.LENGYEL94@login.puny.edu</a><o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">givenName</span></strong>: Florian<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">persistent-id</span></strong>: 49865801<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">sn</span></strong>: Lengyel<o:p></o:p></pre>
<pre><strong><span style="font-family:"Courier New"">uid</span></strong>: 49865801<o:p></o:p></pre>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">All that changed was the regex from a more permissive to a less permissive pattern.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">I have reproduced this on two different systems, with the same software.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">This was how I spent the New Year holiday—it does not compute.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3">Florian<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#98AFF3"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none"><img border="0" width="176" height="96" style="width:1.8333in;height:1.0in" id="Picture_x0020_3" src="cid:image004.png@01DA3CFB.3765B080"></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#00B0F0;mso-ligatures:none">Florian Lengyel, PhD<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#00B0F0;mso-ligatures:none">Identity and Access Management<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#00B0F0;mso-ligatures:none">CUNY CIS 395 Hudson Street, New York, NY 10014<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>