| Subject: | Attributes not decoded from Shibboleth 3 IdP SAML responses |
| Date: | Mon, 4 Jan 2016 11:56:24 -0500 |
| To: | <bug-Net-SAML2 [...] rt.cpan.org> |
| From: | Jorj Bauer <jorj [...] temple.edu> |
Fix is line 49 of Assertion.pm:
- my @values = $node->findnodes('saml:AttributeValue');
+ my @values = ($node->findnodes('saml:AttributeValue'), $node);
$ perl -MNet::SAML2 -e 'print $Net::SAML2::VERSION, "\n";'
0.17
$ perl -MXML::XPath -e 'print ${XML::XPath::VERSION},"\n";'
1.13
Test program:
#!/usr/bin/perl
use strict;
use warnings;
use MIME::Base64 qw/decode_base64/;
use Net::SAML2;
use File::Slurp;
use Data::Dumper;
my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(xml =>
decode_base64(read_file('reply.b64')));
print Dumper $assertion->{attributes};
exit 0;
... does not print any values (it gets the names of the values correct,
with no contents). After the patch, it successfully also shows the values.
Test input file ('reply.b64' referenced above):
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHNhbWwycDpSZXNwb25zZSBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9zZXltb3VyLm9jaXMudGVtcGxlLmVkdS9TaGliYm9sZXRoLnNzby9TQU1MMi9QT1NUI
iBJRD0iXzg1ODBjYTU5NWRhZDY0NDk2M2I3ZDE3ZmViYmQ2NzdkIiBJc3N1ZUluc3RhbnQ9IjIwMTYtMDEtMDRUMTU6NDU6MTguNDI5WiIgVmVyc2lvbj0iMi4wIiB4bWxuczpzYW1sMnA9InVybjpvYXNpczpuYW1lczp0Yz
pTQU1MOjIuMDpwcm90b2NvbCIgeG1sbnM6eHNkPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSI+PHNhbWwyOklzc3VlciB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGl
vbiI+aHR0cHM6Ly9ucC1maW0udGVtcGxlLmVkdS9pZHAvc2hpYmJvbGV0aDwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgo8ZHM6U2ln
bmVkSW5mbz4KPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6L
y93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGE1MTIiLz4KPGRzOlJlZmVyZW5jZSBVUkk9IiNfODU4MGNhNTk1ZGFkNjQ0OTYzYjdkMTdmZWJiZDY3N2QiPgo8ZHM6VHJhbnNmb3Jtcz4KPGRzOlRyYW
5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+CjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3h
tbC1leGMtYzE0biMiPjxlYzpJbmNsdXNpdmVOYW1lc3BhY2VzIFByZWZpeExpc3Q9InhzZCIgeG1sbnM6ZWM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3JtPgo8L2Rz
OlRyYW5zZm9ybXM+CjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGE1MTIiLz4KPGRzOkRpZ2VzdFZhbHVlPnRsOWF1T0JiOUxKaUV4ZjZuZ1NKSU1MQ0hHb
kg1TFRCbXBMOTBZVFhobTh0ZmdRaUdwSmNvelFpWHdMS292a0NKcHBvUHdpZEhZWXIKaVc3ZjljM1F2UT09PC9kczpEaWdlc3RWYWx1ZT4KPC9kczpSZWZlcmVuY2U+CjwvZHM6U2lnbmVkSW5mbz4KPGRzOlNpZ25hdHVyZV
ZhbHVlPgpwRUxYOFJmalkwcjZVcStYS210SFpOTGhWdW5pMzNoTWhvblE0ZW8vVVo0ZGhXUUhoMWE0RUhocTNkU0t0S0NDcndxT2pYTG0zR2ZICksvazRtc1ExZTFlV3prSERVYzkxWEc2YkdudFVhWWN6cUJlcERXTUx2ajF
rR3pZQ0VrdDg4Zy9HSG8waVRKR3dpVXR0SzNNWVpOdTkKdDNNTHFGUCtaL25HTGo5VUdmVFU3TW9uSTVjUnhPbE1pRDhNb2Z2Y3NIbGlxM285b0pYOEttVXZmUDlLU21MS1p5OXh6NVNaZEFVZgpnV0MwaXhKWXFHYURpd2Jj
US83eFZLZlczR25nUnltYXIyUjhsKzdiY0I4RmpOcm05ZkoyV1hjaVdGNGxsOGlvelltRzVYTDlSMCs1CkV4ZlV0ZSttdXVSUGNrb3N0QnJ6a3hiY2JJQmJLcW8yV3FEWWd3PT0KPC9kczpTaWduYXR1cmVWYWx1ZT4KPGRzO
ktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJREx6Q0NBaGVnQXdJQkFnSVVIZ01FQ2Jod05DYkdhcFFpY2xNdmJHVGNkekl3RFFZSktvWklodmNOQVFFRkJRQXdIREVhTUJnRwpBMVVFQXhNUm
JuQXRabWx0TG5SbGJYQnNaUzVsWkhVd0hoY05NVEl4TURBeU1UTTBPRFU0V2hjTk16SXhNREF5TVRNME9EVTRXakFjCk1Sb3dHQVlEVlFRREV4RnVjQzFtYVcwdWRHVnRjR3hsTG1Wa2RUQ0NBU0l3RFFZSktvWklodmNOQVF
FQkJRQURnZ0VQQURDQ0FRb0MKZ2dFQkFNZzREYTVvUlNVNUEyVXlPZEhteHB1MTc5Y0RwN2pMTU5Ic1pOUjlBclJ5YzZvcVRaVFBDRmgzQkoreURoZGpKa3NIRnMvaQpTVkQ3NW5MeUhMYW5xN2FjOHZBTmFFdFYxa0x6bHlo
SFB6aVdHcmxmOEFHSDJkV09TTm0zYkh5MlVRM2xDTXdRV29UNFZULytoZm95CnZYVUxJMGRzZUMrbjdsS2dKdWNOOEFIRThoMFBsL2VGbzZFOHNkMWMrU0MzdENSeGNhcEZyZGpacFFIQXo2MWMyVnBSKytXdkJDTHoKQ0NJW
WlOU0FCRkFldGhEdzk4amR6Yy9UY2NVemt6alJyMXhKQ0FkM2hsRHNMcy9tQ3c0RkJic3k1Y0JidUgreGhqblNHKzA5RG9SKwp5TzFUOXhwenNrNW1QeG5peUJaSU56bmNBN2Fjc3lqQk9Jc3laVklVRUdVQ0F3RUFBYU5wTU
djd1JnWURWUjBSQkQ4d1BZSVJibkF0ClptbHRMblJsYlhCc1pTNWxaSFdHS0doMGRIQnpPaTh2Ym5BdFptbHRMblJsYlhCc1pTNWxaSFV2YVdSd0wzTm9hV0ppYjJ4bGRHZ3cKSFFZRFZSME9CQllFRkhBR2ppZTNqS0c1d3N
wMGY0RDgrU2FiT25vUE1BMEdDU3FHU0liM0RRRUJCUVVBQTRJQkFRQ3FpVUFWUWFuNwp2dDhwaWZqU0JydS8xcXpoakpHWXd2TGcxYzc5SGRNMjFxZGlpaVJQMmVuY0dTbUVxNHcxbTFVanliM1NnOW1UTU5SelU0MnAzSVV3
Clo5bS9RM1lDUVBhcFcxVHFydHgzK2JQbzhvVkN5WCtXRXRpSnlMNHVjTlRqWXZacW52NnpGMUVQYjkxMzQycXVCR3IzeENTby92K3kKcGo5TmZLdnd2UUxCN1NXTkx4akdWbzVEMGlzQmNJTlpGQ2F3MkdHL1plSjAzN2lBS
EtDOWhQRlV6QUNiOW0yN3cvNy9weWNMWjFBNQprSFgyRTlYNklTRDQ3dTRvZ3NrN2ZsalZDMmhNMGcwb1NrbjdTODVLOC9tcnVIdWJPT3BMM3RMcStDZ0tOMGNYenBhblBVa2R1Rks3Cnp3UVJia1NOTUhlcGtweklkU2Qxcm
xjVmNvWlE8L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDJwOlN0YXR1cz48c2FtbDJwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp
0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbDJwOlN0YXR1cz48c2FtbDI6QXNzZXJ0aW9uIElEPSJfM2ZiYzM3NTUzN2IzNGYzNDI2MTlhOTBiNTI2ZDlmZGQiIElzc3VlSW5zdGFudD0iMjAxNi0wMS0wNFQx
NTo0NToxOC40MjlaIiBWZXJzaW9uPSIyLjAiIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj48c2FtbDI6SXNzdWVyPmh0dHBzOi8vbnAtZmltLnRlbXBsZS5lZHUvaWRwL3Noa
WJib2xldGg8L3NhbWwyOklzc3Vlcj48c2FtbDI6U3ViamVjdD48c2FtbDI6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6dHJhbnNpZW50IiBOYW1lUXVhbGlmaWVyPS
JodHRwczovL25wLWZpbS50ZW1wbGUuZWR1L2lkcC9zaGliYm9sZXRoIiBTUE5hbWVRdWFsaWZpZXI9Imh0dHBzOi8vc2V5bW91ci5vY2lzLnRlbXBsZS5lZHUvc2hpYmJvbGV0aCI+QUFkelpXTnlaWFF4cDcydjRIVEE0Znp
CQkN2UFJydXRveVpMSkppV201Ui9DNDYxaWJJT1RkZVlEQ2Jhcm9YNnRYSFZGbW9WQjY3SkhGWmYyY3V0SVpNQ1UrSjZ2SER6SHVaaTU0UXhJbHVRbHJCZVBTbVA2ZTRReTMyb0NGNEpUa2dFVEVENURLUjJRWjRvbm15WnJo
d09MRFpUbGpBak1XOD08L3NhbWwyOk5hbWVJRD48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sMjpTdWJqZWN0Q29uZmlybWF0a
W9uRGF0YSBBZGRyZXNzPSIxNTUuMjQ3LjI2LjE0IiBOb3RPbk9yQWZ0ZXI9IjIwMTYtMDEtMDRUMTU6NTA6MTguNDM0WiIgUmVjaXBpZW50PSJodHRwczovL3NleW1vdXIub2Npcy50ZW1wbGUuZWR1L1NoaWJib2xldGguc3
NvL1NBTUwyL1BPU1QiLz48L3NhbWwyOlN1YmplY3RDb25maXJtYXRpb24+PC9zYW1sMjpTdWJqZWN0PjxzYW1sMjpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxNi0wMS0wNFQxNTo0NToxOC40MjlaIiBOb3RPbk9yQWZ0ZXI
9IjIwMTYtMDEtMDRUMTU6NTA6MTguNDI5WiI+PHNhbWwyOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWwyOkF1ZGllbmNlPmh0dHBzOi8vc2V5bW91ci5vY2lzLnRlbXBsZS5lZHUvc2hpYmJvbGV0aDwvc2FtbDI6QXVkaWVu
Y2U+PC9zYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDI6Q29uZGl0aW9ucz48c2FtbDI6QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDE2LTAxLTA0VDE1OjQ1OjE4LjQyMFoiIFNlc3Npb25JbmRleD0iX
2M0MWU1YWNhZWI0NGEyMDQyMjE1ZmUxM2Q0MTNhZDUyIj48c2FtbDI6U3ViamVjdExvY2FsaXR5IEFkZHJlc3M9IjE1NS4yNDcuMjYuMTQiLz48c2FtbDI6QXV0aG5Db250ZXh0PjxzYW1sMjpBdXRobkNvbnRleHRDbGFzc1
JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDI6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sMjpBdXRobkNvbnRleHQ+PC9zYW1sMjp
BdXRoblN0YXRlbWVudD48c2FtbDI6QXR0cmlidXRlU3RhdGVtZW50PjxzYW1sMjpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJtYWlsIiBOYW1lPSJ1cm46b2lkOjAuOS4yMzQyLjE5MjAwMzAwLjEwMC4xLjMiIE5hbWVGb3Jt
YXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZ
SIgeHNpOnR5cGU9InhzZDpzdHJpbmciPmZ1bmN0aW9uYWwudmVyaWZpY2F0aW9uLnRlc3QwM0B0ZW1wbGUuZWR1PC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIEZyaW
VuZGx5TmFtZT0iZWR1UGVyc29uUHJpbmNpcGFsTmFtZSIgTmFtZT0idXJuOm9pZDoxLjMuNi4xLjQuMS41OTIzLjEuMS4xLjYiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3J
tYXQ6dXJpIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzZDpzdHJpbmciPmZ2dGVzdDAzQHRlbXBsZS5lZHU8
L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjxzYW1sMjpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJnaXZlbk5hbWUiIE5hbWU9InVybjpvaWQ6Mi41LjQuNDIiIE5hbWVGb3JtYXQ9InVybjpvYXNpc
zpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9In
hzZDpzdHJpbmciPkZ1bmN0aW9uYWwgdmVyaWZpY2F0aW9uPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIEZyaWVuZGx5TmFtZT0ic24iIE5hbWU9InVybjpvaWQ6Mi4
1LjQuNCIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1M
U2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHNkOnN0cmluZyI+VGVzdDwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PHNhbWwyOkF0dHJpYnV0ZSBGcmllbmRseU5hbWU9ImNuIiBOYW1lPSJ1c
m46b2lkOjIuNS40LjMiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy
8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzZDpzdHJpbmciPkZ1bmN0aW9uYWwgdmVyaWZpY2F0aW9uIFRlc3Q8L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjwvc2FtbDI6QXR
0cmlidXRlU3RhdGVtZW50Pjwvc2FtbDI6QXNzZXJ0aW9uPjwvc2FtbDJwOlJlc3BvbnNlPg==