requiring multiple claims with multi OP setup

[rajeevn1]

I am using 2.4.10-1~bullseye+1 release from github with multiple providers (google, globus, gitlab).

The following works

<RequireAll>
# Require not claim email_verified:false
Require claim email~^([email protected]|[email protected])$
</RequireAll>

but when I un-comment the claim for email_verified, the authentication always fails. I have confirmed that email_verified claim, as provided by OP, is either set to true (google, gitlab), or is missing (globus).

The issue does not exist if I use any single provider setup.

I would appreciate any help in resolving the issue.

[zandbelt]

Can you provide server debug logs of both cases (for the same OP) so the authorization process can be analyzed?

[rajeevn1]

Log files attached: I have deleted some email regexps and replaced with email~...$

non-working log file:
eb.txt

working log file:
eg.txt

[zandbelt]

thanks, I am able to reproduce this; it appears that combining <RequireAll> with Discovery does not work: including a(ny) 2nd Require directive in such a clause makes it fail; I'll need to investigate more to find a fix, to be continued

[zandbelt]

2.4.11 addresses this