Using a filtered attribute as primary identifier causes an exception

[jkowalc]

Code Version

SATOSA 8.5.1

Expected Behavior

The on_error redirect of the PrimaryIdentifier microservice should be triggered.

Current Behavior

Process ends with an unknown exception.

[2026-08-25 10:48:56,419] [ERROR] [satosa.proxy_server.__call__] Unknown error
Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/satosa/base.py", line 268, in run
    resp = self._run_bound_endpoint(context, spec)
  File "/usr/local/lib/python3.13/site-packages/satosa/base.py", line 193, in _run_bound_endpoint
    return spec(context)
  File "/usr/local/lib/python3.13/site-packages/satosa/backends/saml2.py", line 472, in authn_response
    return self.auth_callback_func(context, self._translate_response(authn_response, context.state))
           ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/satosa/base.py", line 161, in _auth_resp_callback_func
    return self.response_micro_services[0].process(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        context, internal_response)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/satosa/micro_services/attribute_modifications.py", line 42, in process
    return super().process(context, data)
           ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/satosa/micro_services/base.py", line 33, in process
    return self.next(context, data)
           ~~~~~~~~~^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/satosa/micro_services/primary_identifier.py", line 226, in process
    primary_identifier_val = self.constructPrimaryIdentifier(data, ordered_identifier_candidates)
  File "/usr/local/lib/python3.13/site-packages/satosa/micro_services/primary_identifier.py", line 56, in constructPrimaryIdentifier
    values = [ attributes.get(attribute_name, [None])[0] for attribute_name in candidate['attribute_names'] if attribute_name != 'name_id' ]
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^
IndexError: list index out of range

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/satosa/proxy_server.py", line 160, in __call__
    resp = self.run(context)
  File "/usr/local/lib/python3.13/site-packages/satosa/base.py", line 366, in run
    raise SATOSAUnknownError("Unknown error") from e
satosa.exception.SATOSAUnknownError: Unknown error

Possible Solution

In my opinion the PrimaryIdentifier microservice should be fixed to treat empty lists as if the attribute didn't exist.

Steps to Reproduce

1. Set up an attribute filter:

module: satosa.micro_services.attribute_modifications.FilterAttributeValues
name: AttributeFilter
config:
    attribute_filters:
        "":
            "":
                principalname:
                    regexp: "test_regex"

2. Use the attribute in the PrimaryIdentifier microservice:

module: satosa.micro_services.primary_identifier.PrimaryIdentifier
name: PrimaryIdentifier
config:
    ordered_identifier_candidates:
        - attribute_names: [principalname]

3. Make the backend return any principalname that doesn't pass the regex "test_regex"