Uploaded image for project: 'PicketLink'
  1. PicketLink
  2. PLINK-360

SAML Assertion parsing - empty AttributeValue raises exception

    XMLWordPrintable

Details

    • Hide

      Create an assertion with an empty AttributeValue.

      Show
      Create an assertion with an empty AttributeValue.
    • Workaround Exists
    • Hide

      Add xsi:type="xs:string" to the AttributeElement, this results in another path of execution that does not suffer from this bug.

      Show
      Add xsi:type="xs:string" to the AttributeElement, this results in another path of execution that does not suffer from this bug.

    Description

      PLINK2-10 added support for AttributeValue elements with nested elements. However, this 'fix' introduced another issue. Namely, when an AttributeValue exists but its empty it.

      Any of these occurences fail:

      <saml2:AttributeValue />
      
      <saml2:AttributeValue><saml2:AttributeValue/>
      

      throwing a "java.lang.RuntimeException: PL00069: Parser: Type not supported:AttributeValue"

      A 'workaround' (if the XML is not generated by a Gateway) is to add the 'type', e.g.

      <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string" />

      However, the spec states that:

      The <AttributeValue> element supplies the value of a specified SAML attribute. It is of the xs:anyType type, which allows any well-formed XML to appear as the content of the element. If the data content of an <AttributeValue> element is of an XML Schema simple type (such as xs:integer or xs:string), the datatype MAY be declared explicitly by means of an xsi:type declaration in the <AttributeValue> element.

      And with regard to the empty values:

      If a SAML attribute includes an empty value, such as the empty string, the corresponding <AttributeValue> element MUST be empty (generally this is serialized as <AttributeValue/>)

      Attachments

        Activity

          People

            psilva@redhat.com Pedro Igor Craveiro
            blitznl Dick Eimers (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: