Attribute value not being populated in Assertion

Products

• SITEMINDER

Issue/Introduction

An Assertion Attribute has been created based on a SQL Query Schema querying a User Directory in Oracle and using the Get Properties to obtain the different values to use in the assertion attribute definitions

Most of the attributes in the assertion are populated just fine, but some of them are consistently left blank. For instance

<ns2:AttributeStatement>
            <ns2:Attribute Name="attr1"
                           NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                           >
                <ns2:AttributeValue>attr1_value</ns2:AttributeValue>
            </ns2:Attribute>
            <ns2:Attribute Name="attr2"
                           NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                           >
                <ns2:AttributeValue>attr2_value</ns2:AttributeValue>
            </ns2:Attribute>
            <ns2:Attribute Name="attr3"
                           NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                           >
                <ns2:AttributeValue/>
            </ns2:Attribute>
 </ns2:AttributeStatement>

Besides, one of the column names in the sql query schema had a syntax error (e.g. atr3 instead of attr3), but that is still giving this problem

In smtracedefault.log, there are the following statements

[17158][140103200515840][15:25:44][15:25:44.923][10/14/2025][][][][LogMessage:ERROR:[sm-Odbc-00170] Database Error executing query ( 'SELECT DISTINCT atr3 FROM <DB>.<Table_name> WHERE attr1 = <attr1_value>''). Error: Internal Error: DB Transport Error. Code is -4017 (DBMSG: <<<State = 42S22 Internal Code = 904 - s>>>) .][][][][][][][][][][][][][][][SmDsOdbcProvider.cpp:1183][][][]
[17158][140103200515840][15:25:44][15:25:44.923][10/14/2025][][][][Return from call GetUserProp.][][][][][][][][][0][][][][][][SmDsUser.cpp:437][CSmDsUser::GetProp][][]
[17158][140103200515840][15:25:44][15:25:44.924][10/14/2025][][][][Leave function CSmAuthUser::GetPropIndex][][][][][][][][][false][][][][][][SmAuthUser.cpp:2832][CSmAuthUser::GetPropIndex][][]

and indeed in smtracedefault.log  no data is being returned for this and other attributes (not necessarily related)

[17158][140103200515840][15:25:44][15:25:44.906][10/14/2025][][9d7bcb56-efb31950-bebcdf94-a0f185ad-e714ea6f-f9][][Entitlement: NameAttrFormat = unspecified, Encrypt = false, Mode = User, attr3 = NOT PRINTABLE][][][][][][][][][][][][][][][SAMLSPEntitlementGenerator.java][generateValue][][]

...

[17158][140103200515840][15:25:44][15:25:44.924][10/14/2025][][9d7bcb56-efb31950-bebcdf94-a0f185ad-e714ea6f-f9][][Raw Value: ][][][][][][][][][][][][][][][AuthnRequestProtocol.java][processAttributes][][]

Environment

SiteMinder 12.9, probably other versions affected as well

Cause

There are actually two problems here:

• The first one is that despite being corrected in the SQL Query Schema, in smtracedefault.log it is still trying to use the old column name (e.g. instead of attr3, atr3 is being used), which causes a SQL query error
• The second problem is that, even though the assertion generation does not give errors, the incorrect syntax for one of the columns that should be used in the query causes errors in the retrieval of the information which result in some of the attributes not being populated

Resolution

Restarting the Policy Server should resolve the issue

The documentation does not specify to carry out a Policy Server restart upon modification of a SQL Query Schema, but as of October 2025, SE are working on fixing this situation in future releases of the product