CAS 6.4.4 release too much than policy allow

[Gregory G]

Hello,

I have a service with this definition

attributeReleasePolicy: !<org.apereo.cas.services.ReturnMappedAttributeReleasePolicy> allowedAttributes: !<java.util.TreeMap> mail: !<java.util.ArrayList> - "mail" principalAttributesRepository: !<org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository> attributeRepositoryIds: !<java.util.HashSet> - "*" consentPolicy: !<org.apereo.cas.services.consent.DefaultRegisteredServiceConsentPolicy> status: "FALSE" excludeDefaultAttributes: true authorizedToReleaseAuthenticationAttributes: false

But if i use existing SSO session : i get my allowed attribute + authentification attributes (clientIp, UsernamePasswordPrincipal, etc..)

If i use fresh session : no problem

[Gregory G]

Hello,

I tried on CAS 6.2, the issue is not existing, everything working well