Sometimes oxTrust won't modify Shibboleth config files when new attribute is added for a while

[aliaksander-samuseu]

Description

When new attribute is created and then added to some SAML Trust Relationship, at times oxTrust won't actually push the changes to corresponding Shibboleth for a while. It's normally fixed by restarting "identity" service, but may create a lot of confusion as user expects that the changes to IDP should already at least reach the configuration on disk. It also makes troubleshooting harder when dealing with attributes releases issues.

Steps To Reproduce

1. Add a custom attribute to LDAP schema and register it in oxTrust
2. Create a SAML TR of any kind and add the new attribute to it
3. Run next command in the container: # grep -l -i -r -e 'YOUR_ATTR_NAME' /opt/shibboleth-idp/conf/

Expected behavior

At least next three files must contain the newly added attribute right after configuration was applied in oxTrust:

/opt/shibboleth-idp/conf/attribute-resolver.xml
/opt/shibboleth-idp/conf/attribute-filter.xml
/opt/shibboleth-idp/conf/attributes/gluu-attribute-rules.xml

Actual behavior

Very often you can see it in just two of the files - it's missing from gluu-attribute-rules.xml file. That's what happened in customer's setup where the issue was first encountered. The attribute won't be released in such case. While I was testing by adding and removing the attribute from TRs and the attribute itself from the server, I've seen various delays in IDP configuration updates. The attribute can be added to a TR, but it still won't appear in IDP's config after a few minutes. It can be removed from the server, but still will be listed in gluu-attribute-rules.xml file for a while, but won't disappear even if "identity" is restarted.

Ideally, we want these configuration changes to be pushed to IDP's config without need to restart anything.

[aliaksander-samuseu]

It seems that updating the /opt/shibboleth-idp/conf/attributes/gluu-attribute-rules.xml file may happen after the attribute registered in oxTrust, not after you add it to TR. But still sometimes happens with such long delay it's easier to restart oxTrust.