Bug: Transformation Engine Runs Twice, Causing Doubled Values or an Empty WSFed AttributeStatement

Version Affected: All
Bug Number: IDP-2515, EE-1781
Bug Status: Open - No Permanent Fix
Fixed in Version(s): EE-1781 (empty WSFed AttributeStatement) is addressed in hotfix 9.1.0-56 and 19.07.01-12. IDP-2515 (doubled transformed values) is not yet fixed as of this article's last review — check current release notes for status.

 

Overview

This article explains a defect where the Transformation Engine applies its edit to a value twice, which can either double a transformed value or, on WSFed realms, produce a missing or empty AttributeStatement in the resulting assertion.

 

Cause

The Transformation Engine is erroneously invoked twice for the same value. Depending on the transformation and the realm type, this produces one of two symptoms:

• On any realm, a value edited by the Transformation Engine is transformed twice, doubling text that was only meant to be added once. For example, editing SamAccountName to Domain\SamAccountName can instead produce Domain\Domain\SamAccountName, causing the assertion to fail. (IDP-2515)
• On WSFed realms specifically, if the XSLT includes <xsl:when> conditions without a matching <xsl:otherwise>, the double execution instead causes the AttributeStatement in the resulting assertion to be missing attributes or empty entirely — even though switching the same realm to issue a SAML assertion instead of WSFed produces the expected output. (EE-1781)

Resolution / Workaround

For the WSFed empty-AttributeStatement scenario (EE-1781): Upgrade to hotfix 9.1.0-56 or 19.07.01-12, or later, to resolve this issue.

For the doubled-value scenario (IDP-2515), which remains open, use Token settings instead of the Transformation Engine to make the change:

1. On the realm's Workflow tab, set Token Data Type (Send) to Custom, then enter the custom token in Custom Token Fields — for example, Example\{UserID} to send a fixed prefix followed by the user's ID.
   
2. On the Post Authentication tab, set the corresponding claim's Value to Custom Token Value.
   

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.