ECMA to access SubjectCanonicalizationContext in Resolver

[Michael A Grady]

> On Nov 10, 2015, at 7:24 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
> On 11/10/15, 7:19 PM, "dev on behalf of Michael A Grady" <dev-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:
> 
> 
>> 
>> So I seem to be be getting a null from 'parent = resolutionContext.getParent();'  Or maybe I missed a leaf in the tree walking down from there. Here are the pieces I have, with c14n now configured to use attribute:
> 
> The parent of the resolutionContext *is* the profile request context. I think the null is the second line calling getSubcontext, by my count.
> 
> It's just resolutionContext.getParent().getSubcontext("...SubjectCanonicalizationContext").getSubject()
> 

Thanks; from looking at the javadocs for the packages etc. I had gotten the impression there were more levels than that.

So I finally have this working.  Thanks for your help, Scott.

The one remaining question would be "is there any simple activation condition I could use to get this special Data Connector (DC) and this attribute definition to only run at c14n time"? I.e. so the normal resolution step doesn't try to run it? Because I needed to account for that in the script, in order to ensure that there was at least one "empty" value for the attribute, so the associated DC didn't error out when it tried to resolve rawUsername.get(0). Maybe there is a better way to handle the latter?

Here are the pieces I added to the attribute-resolver.xml for this. Of course, for one to actually need this (versus Simple), that LDAP search filter would need to be checking at least 2 fields for the rawUsername, because the whole point of having all of this would be if the user was allowed to enter their username in more than one form.


    <resolver:AttributeDefinition id="rawUsername" xsi:type="ad:Script">
      <ad:Script><![CDATA[
        // load compatibility script
        load("nashorn:mozilla_compat.js");
        importPackage(Packages.net.shibboleth.idp.authn.principal);
        importPackage(Packages.org.slf4j);
        logger = LoggerFactory.getLogger("net.shibboleth.idp.attribute.resolver.c14nAttribute");
        logger.debug("Creating rawUsername");
        subjectContext = resolutionContext.getParent().getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext");
        if (subjectContext != null) {
           subjectP = subjectContext.getSubject();
           userProvidedUsername = subjectP.getPrincipals(UsernamePrincipal.class).iterator().next().getName();
           rawUsername.addValue( userProvidedUsername );
           logger.debug("rawUsername set to: " + rawUsername.getValues().get(0));
        } else {
           logger.debug("No subject context");
           rawUsername.addValue( '' );
        }
      ]]></ad:Script>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="uidC14n" sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAPc14n" />
    </resolver:AttributeDefinition>

    <!-- LDAP Connector for c14n processing -->
    <resolver:DataConnector id="myLDAPc14n" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://localhost:10389"
        baseDN="ou=People,dc=example,dc=edu"
        principal="cn=admin,dc=example,dc=edu"
        principalCredential="password">
        <resolver:Dependency ref="rawUsername" />
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$rawUsername.get(0))
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid</dc:ReturnAttributes>
    </resolver:DataConnector>


--
Michael A. Grady
IAM Architect, Unicon, Inc.