"Response attribute will be trimmed" warning for SAML attributes in Federation

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign-On
• SITEMINDER
• CA Single Sign On Federation (SiteMinder)

Issue/Introduction

SAML attributes in a Federation assertion, such as group membership ("memberOf"), have a maximum length before being truncated at the relying party. This commonly affects large directory environments where users belong to many groups, and a truncated attribute can break downstream authorization at the service provider.

When truncation occurs, the Policy Server logs a warning to "smtracedefault.log":

...
[WARNING: Response attribute will be trimmed. [attr = SMUSERGRP:memberOf] [actual attr len = <n>] [response attr len = <n>]]
...

Environment

• SiteMinder Policy Server 12.8SP8 and later
• OS: Windows or Linux/UNIX

Cause

SiteMinder enforces an internal attribute-length limit in "EntitlementGenerator.properties", independent of any web server HTTP header limit, to bound memory usage during assertion generation. The default limit is 1024 characters; attributes exceeding it are truncated before the assertion is sent to the service provider.

Resolution

1. On the Policy Server, open "<PS_Installation_path>\config\properties\EntitlementGenerator.properties".
2. Locate the property matching the federation protocol in use [1]:
   
   WS-Federation — "com.netegrity.assertiongenerator.wsfed.MaxUserAttributeLength"
   SAML 1.x — "com.netegrity.assertiongenerator.saml1.MaxUserAttributeLength"
   SAML 2.0 — "com.netegrity.assertiongenerator.saml2.MaxUserAttributeLength"
   
   
3. Increase the value based on the "actual attr len" reported in the log entry above. The value is a positive integer; the maximum supported value is 2,147,483,647. A common increase is to 4096 or higher.
4. Save the file and restart the Policy Server.

Avoid setting the value far beyond what's actually needed: an oversized value can overflow the data transfer buffer, causing SiteMinder to fall back to the default value instead of the configured one. Also confirm the web server and service provider can handle the resulting assertion size — web servers enforce their own independent header limits regardless of this setting, for example Apache (~8 KB), Nginx (~4–8 KB), IIS (~8–16 KB), and Tomcat (~8–48 KB). See [2] for the broader question of overall SAML assertion size limits.

Additional Information

1. (Optional) Configure Attributes for Assertions
   
   
2. SAML assertion size limit at the Assertion Consumer in Federation