scripted attribute definition: non-JavaScript/non-Rhino ?

[Peter Schober]

* Chad La Joie <lajoie at itumi.biz> [2012-02-09 12:51]:
> I haven't not done it, but I am aware of people who have used Python
> and Clojure (this one was on the list a while back).  So, I can at
> least say that it is possible.

Yes, I recall someone trying with Python (or PHP/Quercus) and not
getting any of the values created in the script returned -- which I
also experience now with Jython, e.g.

    from edu.internet2.middleware.shibboleth.common.attribute.provider import BasicAttribute
    from org.slf4j import LoggerFactory
    logger = LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.foo")
    # do stuff here: calculate age based on schacDateOfBirth
    try:
        eduPersonEntitlement
    except NameError:
        logger.debug("No eduPersonEntitlement, creating one")
        eduPersonEntitlement = BasicAttribute("eduPersonEntitlement")

    if age <= 25:
        logger.debug("Eligible for youth discount, setting entitlement")
        eduPersonEntitlement.getValues().add("http://example.org/youth-discount")
    else:
        logger.debug("Age not within range, doing nothing")

Either way (age <= n or not, i.e. with the entitlement added or not)
it ends up with a "null attribute" and resolving of all attributes fails:

  18:36:20.731 - ERROR
  [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition:129]
  - attributeId produced a null attribute

  18:36:20.731 - WARN
  [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:478]
  - Error resolving attributes for principal 'someuser'.  No name
  identifier or attribute statement will be included in response

Logging values of eduPersonEntitlement.getValues() shows everything as
intended until the script finishes.

I'll probbaly end up rewriting the darn thing for Rhino (making use of
org.joda.time which I just noticed was included, for those age
calculations) but thought I'd still ask here.
-peter