ECMA to access SubjectCanonicalizationContext in Resolver

[Michael A Grady]

> On Nov 10, 2015, at 12:53 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
> On 11/10/15, 12:05 PM, "dev on behalf of Michael A Grady" <dev-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:
> 
> 
> 
>> Based on the conversation on Shib Users, I've been trying to put an attribute definition in the resolver to access the underlying username the user entered at login. I started with the pretty simple one liner that Scott had suggested, but keep getting "null" returned from trying to bring in the SubjectCanonicalizationContext.
> 
> My one liner elided the fact that the profile context variable wasn't populated, that was fixed for 3.2. For the moment you have to walk up from the resolutionContext via getParent and then down. That said, I would have thought the error message would be slightly different.

Ah, ok.

> 
> Also, though, "when" are you running this? If it's not during subject c14n, I don't think that context would still be around. It would be there only if you run the resolver during that step.

That's probably it, as far as why I'm getting the error I'm getting. I was just trying to test the script, and hadn't changed c14n to activate the attribute-based flow. So I'll do that when I make the changes to "walk the tree" as you specify is needed with 3.1.2.

But that does raise the question of what happens the "2nd time thru", during the standard resolution time. Will the value set at c14n-time still be around, so a check to be sure it already has a value is sufficient to keep it from trying to access that context again? Or just test the context, and if null, assume this is already pat the c14n time?


--
Michael A. Grady
IAM Architect, Unicon, Inc.