<div dir="ltr">I have seen this when you have AttributeEncoders in both your attribute-resolver configuration and the Attribute Registry configuration.<div><br></div><div>In your example, all of the attributes should have an encoding configuration defined in conf/attributes/eduPerson.xml ... so you would want to remove any encoding configuration from the AttributeDefintion block within your resolve.</div><div><br></div><div>Steve.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 25, 2024 at 12:34 PM Conner, Mike via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg7629943214123767812">
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif;color:rgb(0,0,0)">
<span style="font-size:12pt">I wonder if anyone could help me troubleshoot an issue I haven't been able to understand. My Shib IdP is adding duplicate attribute values to the outgoing assertion.<br>
In the logs it appears that eduPersonScopedAffiliation has 1 value, eduPersonAffiliation has 1 value and eduPersonAssurance has 4 values.<br>
When these values are added and encoded for the assertion, they are duplicated.<br>
Where and why is this happening?<br>
<br>
</span><span style="font-size:11pt">*** LOGS ***</span><span style="font-size:12pt"><br>
</span><span style="font-family:Consolas,Courier,monospace;font-size:11pt">DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter':
</span><span style="font-family:Consolas,Courier,monospace;font-size:11pt;background-color:rgb(255,255,0)">1 values for attribute 'eduPersonAffiliation'</span><span style="font-family:Consolas,Courier,monospace;font-size:11pt"> remained after
filtering</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter':
<span style="background-color:rgb(255,255,0)">1 values for attribute 'eduPersonScopedAffiliation'</span> remained after filtering</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter':
<span style="background-color:rgb(255,255,0)">4 values for attribute 'eduPersonAssurance'</span> remained after filtering</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
...</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
DEBUG [net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:265] - Profile Action AddAttributeStatementToAssertion: Attempting to add an AttributeStatement to outgoing Assertion</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonAssurance as a SAML 2 Attribute</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance" target="_blank">https://refeds.org/assurance</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance/ID/eppn-unique-reassign-1y" target="_blank">https://refeds.org/assurance/ID/eppn-unique-reassign-1y</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance/IAP/low" target="_blank">https://refeds.org/assurance/IAP/low</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance/IAP/medium" target="_blank">https://refeds.org/assurance/IAP/medium</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance" target="_blank">https://refeds.org/assurance</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance/ID/eppn-unique-reassign-1y" target="_blank">https://refeds.org/assurance/ID/eppn-unique-reassign-1y</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance/IAP/low" target="_blank">https://refeds.org/assurance/IAP/low</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="https://refeds.org/assurance/IAP/medium" target="_blank">https://refeds.org/assurance/IAP/medium</a> of attribute eduPersonAssurance</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonScopedAffiliation as a SAML 2 Attribute</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="mailto:member@grinnell.edu" target="_blank">member@grinnell.edu</a> of attribute eduPersonScopedAffiliation</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value <a href="mailto:member@grinnell.edu" target="_blank">member@grinnell.edu</a> of attribute eduPersonScopedAffiliation</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonAffiliation as a SAML 2 Attribute</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member of attribute eduPersonAffiliation</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)">DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member of attribute eduPersonAffiliation</span></div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
*** END LOGS ***</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
*** RESULTING ASSERTION ***</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<saml2:AttributeStatement></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<saml2:Attribute FriendlyName="eduPersonAssurance"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> <saml2:AttributeValue><a href="https://refeds.org/assurance" target="_blank">https://refeds.org/assurance</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> <saml2:AttributeValue><a href="https://refeds.org/assurance/ID/eppn-unique-reassign-1y" target="_blank">https://refeds.org/assurance/ID/eppn-unique-reassign-1y</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> <saml2:AttributeValue><a href="https://refeds.org/assurance/IAP/low" target="_blank">https://refeds.org/assurance/IAP/low</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> <saml2:AttributeValue><a href="https://refeds.org/assurance/IAP/medium" target="_blank">https://refeds.org/assurance/IAP/medium</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)"> <saml2:AttributeValue><a href="https://refeds.org/assurance" target="_blank">https://refeds.org/assurance</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)"> <saml2:AttributeValue><a href="https://refeds.org/assurance/ID/eppn-unique-reassign-1y" target="_blank">https://refeds.org/assurance/ID/eppn-unique-reassign-1y</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)"> <saml2:AttributeValue><a href="https://refeds.org/assurance/IAP/low" target="_blank">https://refeds.org/assurance/IAP/low</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,0)"> <saml2:AttributeValue><a href="https://refeds.org/assurance/IAP/medium" target="_blank">https://refeds.org/assurance/IAP/medium</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
</saml2:Attribute></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> <saml2:AttributeValue><a href="mailto:member@grinnell.edu" target="_blank">member@grinnell.edu</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,128)"> <saml2:AttributeValue><a href="mailto:member@grinnell.edu" target="_blank">member@grinnell.edu</a></saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
</saml2:Attribute></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<saml2:Attribute FriendlyName="eduPersonAffiliation"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> xsi:type="xsd:string"</span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(128,255,128)"> >member</saml2:AttributeValue></span></div>
<div style="font-family:Consolas,Courier,monospace;font-size:11pt;color:rgb(0,0,0)">
<span style="background-color:rgb(255,255,128)"> <saml2:AttributeValue>member</saml2:AttributeValue></span></div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
<span style="font-family:Consolas,Courier,monospace"> </saml2:Attribute></span><br>
*** END ASSERTION ***</div>
<br>
<p style="font-family:Calibri;font-size:10pt;color:rgb(0,0,0);margin:5pt;font-style:normal;font-weight:normal;text-decoration:none" align="Center">
Internal<br>
</p>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>