Example on Wiki IdPFilterRequirementScript

[Cantor, Scott]

On 8/15/13 12:06 AM, "Michael Stroucken" <mxs at cmu.edu> wrote:

>Hi,
>
>I am looking at the example given in
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirementS
>cript 
>. If the getAttributesRequestContext() function is called on the
>ShibbolethFilteringContext object, the SAMLProfileRequestContext return
>is dependent on the attributes the SP is requesting, right?

No, SPs don't in general (really never) request attributes. IdPs resolve a
set of attributes, and that set is what the filter context contains. It's
immaterial to the filtering step why an attribute is part of the set.

>If the SP is not requesting any attributes, or not the "uid" attribute
>given in the example, this will fail because there are no null checks.

The example doesn't contain any null checking, no. It has nothing to do
with an SP requesting anything. If the "uid" attribute is in the resolved
set, it would work, and if not, it wouldn't.

-- Scott