<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi all,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
### Operating Environment Information</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
operating_system: Linux</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
operating_system_version: 4.18.0-553.36.1.el8_10.x86_64</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
operating_system_architecture: amd64</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
jdk_version: 17.0.14</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
available_cores: 2</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
used_memory: 144 MB</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
maximum_memory: 256 MB</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
### Identity Provider Information</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
idp_version: 5.1.3</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I'm trying to configure Revocation based on openLDAP's attribute pwdChangedTime since we want to invalidate all sessions once a users password has changed.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506431/AdministrativeLogoutConfiguration#Attribute-Based-Revocation" id="LPlnk">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506431/AdministrativeLogoutConfiguration#Attribute-Based-Revocation</a></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
To do this I have used this configuration</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>conf/authn/authn.properties</b></div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<ul data-editing-info="{"applyListStyleFromLevel":true}" style="list-style-type: disc;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div class="elementToProof" style="line-height: 22px;">idp.authn.revocation = true</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div class="elementToProof" style="line-height: 22px;">idp.authn.revocation.attributeId = 'revocation'</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div class="elementToProof" style="line-height: 22px;">idp.authn.revocation.Condition = 'shibboleth.AttributeRevocationCondition'</div>
</li></ul>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>conf/attribute-resolver.xml</b></div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<AttributeDefinition id="revocation" xsi:type="DateTime" epochInSeconds="true"></div>
<div style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<InputDataConnector ref="ldap" attributeNames="pwdChangedTime" /></div>
<div style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<AttributeEncoder xsi:type="SAML2DateTime " name="revocation" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" friendlyName="revocation" encodeType="false" /></div>
<div style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</AttributeDefinition></div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>idp-process.log</b></div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="line-height: 22px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:14:17,183 - - DEBUG [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:89] - Parsing configuration for AttributeDefinition plugin with id: revocation</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:14:18,329 - - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:669] - Attribute Resolver 'ShibbolethAttributeResolver': Checking if attribute definition 'revocation' has a circular dependency</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:14:18,496 - - DEBUG [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:89] - Parsing configuration for AttributeDefinition plugin with id: revocation</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:14:18,660 - - DEBUG [net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl:345] - Attribute mapping: revocation <-> SAML2:{urn:oasis:names:tc:SAML:2.0:attrname-format:uri}revocation via SAML2DateTimeAttributeTranscoder</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:07,306 - - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:279] - Registered flow ID 'admin/revocation' using 'class path resource [net/shibboleth/idp/flows/admin/revocation-flow.xml]'</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:07,325 - - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:279] - Registered flow ID 'oauth2/revocation' using 'URL [jar:file:/opt/apache-tomcat-10.1.25/webapps/idp/WEB-INF/lib/idp-plugin-oidc-op-impl-4.1.0.jar!/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml]'</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:31,546 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:455] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'revocation'</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:31,547 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:131] - Attribute Definition 'revocation': produced an attribute with no values</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:31,547 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:336] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'revocation' produced an attribute with 0 values</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:31,583 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:466] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null filtering) attribute definition revocation result</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:31,583 - 192.168.75.2 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:528] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'revocation', contains no values</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2025-02-10 21:17:46,624 - 192.168.75.2 - DEBUG [net.shibboleth.idp.authn.revocation.impl.AttributeRevocationCondition:168] - Checking revocation for principal name REDACTED for authn/Password result via attribute resolver</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" id="Signature">
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;">The main issue appears to be that the attribute definition "revocation" returns no values. Have I got the definition correct?</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"><br>
</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">ldapsearch returns the attributes for the ldap account configured in ldap.properties</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);"> dn: uid=glipscom,REDACTED,REDACTED.edu.au</span></p>
<div style="margin-right: 40px; margin-left: 40px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
cn: Gary Lipscomb</div>
<div style="margin-right: 40px; margin-left: 40px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
mail: glipscomb@csu.edu.au</div>
<div style="margin-right: 40px; margin-left: 40px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
pwdChangedTime: 20250209221240Z</div>
<p style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);"><br>
</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">These are the AttributeDefinition's I tried all resulting in no values retrieved</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);"><br>
</span></p>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<AttributeDefinition id="revocation" xsi:type="DateTime" epochInSeconds="true"></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<InputDataConnector ref="ldap" attributeNames="pwdChangedTime" /></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<AttributeEncoder xsi:type="SAML2DateTime " name="revocation" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" friendlyName="revocation" encodeType="false" /></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
</AttributeDefinition></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<AttributeDefinition id="pwdChangedTime" xsi:type="DateTime" epochInSeconds="true"></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<InputDataConnector ref="ldap" attributeNames="pwdChangedTime" /></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
</AttributeDefinition></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<AttributeDefinition id="authTimestamp" xsi:type="Simple"></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<InputDataConnector ref="ldap" attributeNames="authTimestamp" /></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
</AttributeDefinition></div>
<div style="line-height: 22px; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="margin-top: 1em; margin-bottom: 1em; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
regards</div>
<div style="margin-top: 1em; margin-bottom: 1em; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Gary</div>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);"><br>
</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"><br>
</span></p>
<table cellspacing="0" cellpadding="0" style="box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="width: 13cm; height: 45.95pt; border-bottom: 1pt solid rgb(237, 125, 49); padding: 0cm; vertical-align: top;">
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(218, 61, 15);"><b>Gary Lipscomb</b></span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 9pt;">Technical Officer, Systems</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 9pt;">IT </span><span style="font-family: Arial, sans-serif; font-size: 9pt; color: rgb(65, 65, 65);">Infrastructure & Security | Division of Information Technology</span></p>
</td>
</tr>
<tr>
<td style="width: 13cm; height: 65.65pt; padding: 0cm; vertical-align: top;">
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"><br>
</span></p>
</td>
</tr>
</tbody>
</table>
<p> </p>
<p> </p>
</div>
<!DOCTYPE html>
<title>Charles Sturt University</title>
<style>p {font-family:arial, helvetica, sans-serif;font-size:9px;}</style>
<p><a href="https://www.csu.edu.au" style="text-decoration:none;"><img alt="Charles Sturt" style="height:60px;padding:10px;" src="https://www.csu.edu.au/email/images/charles-sturt-logo/charles-sturt-university-logo.png"></a></p>
<hr>
<p style="font-weight:bold">LEGAL NOTICE</p>
<p>This email (including correspondence comprising an email chain and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in
reliance on it or disclose it to anyone.<br>
Any confidentiality is not waived or lost by reason of mistaken delivery. Any email should be checked for viruses and defects before opening. Charles Sturt University does not accept liability for viruses or any consequence which arise as a result of this email
transmission. Email communications with Charles Sturt University may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at Charles Sturt University. The views expressed in this email
are not necessarily those of Charles Sturt University.</p>
<p><a style="color:#da3d0f;" href="https://www.csu.edu.au">Charles Sturt University in Australia</a> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551). Charles Sturt University - TEQSA Provider Identification: PRV12018
(Australian University). CRICOS Provider: 00005F.</p>
<p>Consider the environment before printing this email.</p>
</body>
</html>