Shibboleth Developers

[Ian Young <>]

Scott Cantor wrote:

> To fix, change the first line to:
>
> nameIDNode.setAttributeNS(
> org.opensaml.XML.XMLNS_NS,"xmlns", XML.SAML2ASSERT_NS);
>
> Or something close.

I did exactly that on a fresh 1.3c IdP distribution and replaced my IdP.

> If this fixes it, I win a big stuffed furry animal.

And... we have a winner.  My SP is now validating signed assertions from 
my IdP that include that attribute.

I'll leave you to file the bugzilla report so that you can claim your 
stuffed animal from Howard at the same time.

> And continue to wonder
> exactly how my life ended up here, debugging XML signature solely through
> visual exam.

You probably did something unspeakable in a previous life.  It's the 
only explanation.

I think that closes the book on the signed assertion question.

For your amusement, note that the thing about "skipping AttributeValue 
without a single, non-empty text node" has mysteriously disappeared, 
possibly after I restarted shibd.  I'll let you know if it turns up 
again sometime.

Unfortunately I now observe that the new-style ePTI values aren't 
actually making it through to the application headers.  Instead, the CGI 
variable is created but apparently with an empty value.  I switched 
temporarily back to my previous IdP, and same problem with that one. 
Now I know this used to work (I have seen the a!b!c format in CGI 
variables), but I think I upgraded the SP from 1.3-6 or thereabouts to 
1.3-8 since then, and there may have been an FC3 to FC4 upgrade as well. 
 Anything in those patches that might have disturbed the special 
attribute factory?

Just to confirm: my shibboleth.xml *does* contain the AttributeFactory 
clause, and the shibd.log contains a line claiming it is building an 
appropriate factory.

        -- Ian