Password Scripted Attribute Error

[Michael Parente]

Hello all,

I sent this out a couple of weeks ago but didn't get any responses so I 
figured I'd send it again in case it was missed. Any suggestions or 
assistance would be greatly appreciated.

We are using LDAP user/pass authentication with Shibboleth IdP 2.3.5. We 
currently extract the password as an attribute for one specific internal 
SP using this code:

<!-- Add password as attribute-->
<resolver:AttributeDefinition id="password" xsi:type="Script" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad">
<resolver:AttributeEncoder xsi:type="SAML1String"
         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
         name="urn:mace:dir:attribute-def:password" />

<resolver:AttributeEncoder xsi:type="SAML2String"
         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
         name="urn:oid:2.5.4.35"
         friendlyName="password" />
<Script>
<![CDATA[
            
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
            
importPackage(Packages.edu.internet2.middleware.shibboleth.idp.authn.provider);
            importPackage(Packages.java.io.*);

         // Create new password attribute
            password = new BasicAttribute("password");
         // Get subject only if the session exists (to avoid smal1)
            if( requestContext.getUserSession() )
            {
                 // Get Subject
            userSubject = requestContext.getUserSession().getSubject();
         // There are two PrivateSessions existed, only get class 
UsernamePasswordCredential
            i = 
userSubject.getPrivateCredentials(edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordCredential).iterator();
            while(i.hasNext()) {
               credential = i.next();
                   password.getValues().add(credential.getPassword());
            }
         }
            ]]>
</Script>
</resolver:AttributeDefinition>

This has worked fine for us over the past few years. Lately, however, 
whenever we restart the IdP we sometimes get the following error in 
idp-process.log:

WARN 
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition:153] 
- password unable to compile even though the scripting engine supports 
this functionality.

This error happened in our old 2.1.5 IdP as well as the new 2.3.5 
instance. It seems that the error shows up completely at random. 
Sometimes after a restart we don't get it at all, other times it will 
appear once and then not come back after another reboot, and other times 
we will have to keep restarting the IdP several times for it to not 
appear. When it does appear, though, SPs will be able to create valid 
sessions with the IdP, but no attributes will be released to any SP.

Does anyone have an explanation as to why this error shows up at random 
or what is causing it?

Thanks,
Mike
Stevens Institute of Technology
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120223/7678ab4b/attachment.html