ECMA to access SubjectCanonicalizationContext in Resolver

[Michael A Grady]

> On Nov 10, 2015, at 3:03 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> But that does raise the question of what happens the "2nd time thru", during the standard resolution time. Will the value set at c14n-time still be around, so a check to be sure it already has a value is sufficient to keep it from trying to access that context again? Or just test the context, and if null, assume this is already pat the c14n time?
> 
> Nothing is still around except for cached connector results. Attribute definitions are never cached. I don't recall if the result set caching is implemented in a way that would allow the scripted connector to have cached results, but I don't think so.
> 
> Either way, you would need the error handling there and just have it not resolve any data. I think it's generally cleaner to have a very separate attribute/connector sequence for that use case than anything running the rest of the time.


So I seem to be be getting a null from 'parent = resolutionContext.getParent();'  Or maybe I missed a leaf in the tree walking down from there. Here are the pieces I have, with c14n now configured to use attribute:

<resolver:AttributeDefinition id="rawUsername" xsi:type="ad:Script">
   <ad:Script><![CDATA[
        // load compatibility script
        load("nashorn:mozilla_compat.js");
        importPackage(Packages.org.opensaml.messaging.context);
        importPackage(Packages.org.opensaml.profile.context);
        importPackage(Packages.net.shibboleth.idp.authn.context);
        importPackage(Packages.net.shibboleth.idp.authn.principal);
        importPackage(Packages.org.slf4j);
        logger = LoggerFactory.getLogger("net.shibboleth.idp.attribute.resolver.c14nAttribute");
        if (typeof rawUsername == "undefined" || rawUsername.getValues().size() < 1) {
                logger.debug("Creating rawUsername");
                //subjectP = Java.type("javax.security.auth.Subject");
                parent = resolutionContext.getParent();
                child = parent.getSubcontext("org.opensaml.messaging.context.InOutOperationContext");
                grandchild = child.getSubcontext("org.opensaml.profile.context.ProfileRequestContext");
                subjectContext = grandchild.getSubcontext(
                        "net.shibboleth.idp.authn.context.SubjectCanonicalizationContext");
                if (subjectContext != null) {
                  subjectP = subjectContext.getSubject();
                  userProvidedUsername = subjectP.getPrincipals(UsernamePrincipal.class).iterator().next().getname();
                        rawUsername.addValue( userProvidedUsername );
                  logger.debug("rawUsername set to: " + rawUsername.getValues().get(0));
                } else {
                        logger.debug("No subject context");
                }
        }
        ]]></ad:Script>
</resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="uidC14n" sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAPc14n" />
    </resolver:AttributeDefinition>

   <!-- Example LDAP Connector -->
    <resolver:DataConnector id="myLDAPc14n" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://localhost:10389"
        baseDN="ou=People,dc=example,dc=edu"
        principal="cn=admin,dc=example,dc=edu"
        principalCredential="password">
        <resolver:Dependency ref="rawUsername" />
        <dc:FilterTemplate>
            <![CDATA[
                (uid=${rawUsername})
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid mail</dc:ReturnAttributes>
    </resolver:DataConnector>


Log entries from after username/password authn succeeds:

2015-11-11 00:05:18,074 - INFO [org.ldaptive.auth.Authenticator:259] - Authentication succeeded for dn: uid=jsmith,ou=People,dc=example,dc=edu
2015-11-11 00:05:18,075 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'jsmith' succeeded
2015-11-11 00:05:18,078 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:274] - Profile Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s) defined on underlying flow descriptor
2015-11-11 00:05:18,141 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 4 canonicalization flows into SubjectCanonicalizationContext
2015-11-11 00:05:18,146 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/attribute for applicability...
2015-11-11 00:05:18,146 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/attribute
2015-11-11 00:05:18,194 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:183] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution
2015-11-11 00:05:18,194 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:191] - Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve the following attribute definitions [rawUsername, uidC14n]
2015-11-11 00:05:18,196 - DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:189] - Attribute Definition 'rawUsername': adding to-be-populated attribute to script context
2015-11-11 00:05:18,197 - DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:195] - Attribute Definition 'rawUsername': adding contexts to script context
2015-11-11 00:05:18,198 - DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:204] - Attribute Definition 'rawUsername': adding emulated V2 request context to script context
2015-11-11 00:05:18,788 - DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedIdPAttributeImpl:89] - Attribute Definition 'rawUsername': scripted attribute 'rawUsername': values being prepared
2015-11-11 00:05:18,789 - DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedIdPAttributeImpl:104] - Attribute Definition 'rawUsername': scripted attribute 'rawUsername': values are : []
2015-11-11 00:05:18,808 - DEBUG [net.shibboleth.idp.attribute.resolver.c14nAttribute:10] - Creating rawUsername
2015-11-11 00:05:18,894 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:256] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'rawUsername': unable to execute script
        at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition.doAttributeDefinitionResolve(ScriptedAttributeDefinition.java:148)
Caused by: javax.script.ScriptException: TypeError: null has no such function "getSubcontext" in <eval> at line number 14
        at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:455)
Caused by: jdk.nashorn.internal.runtime.ECMAException: TypeError: null has no such function "getSubcontext"
        at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)
2015-11-11 00:05:18,914 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
java.lang.IllegalArgumentException: Cannot find state with id 'UnableToResolveAttributes' in flow 'c14n/attribute' -- Known state ids are:
 'array<String>['AttributeSourcedSubjectCanonicalization', 'proceed', 'InvalidProfileContext', 'InvalidSubject', 'InvalidSubjectContext', 'InvalidSubjectCanonicalizationContext', 'NoPotentialFlow', 'ReselectFlow', 'RuntimeException', 'SubjectCanonicalizationError', 'LogRuntimeException']'
        at org.springframework.webflow.engine.Flow.getStateInstance(Flow.java:342)

--
Michael A. Grady
IAM Architect, Unicon, Inc.