Password Scripted Attribute Error

[Chad La Joie]

The only suggestion I have to turn on debugging for Rhino, the
ECMAscript implementation used by the IdP, and see if that tells you
anything more.  The IdP doesn't have any real control over that part
of the process.  It asks the engine if it support compilation and if
so passes it the script and says "compile this".  Everything else is
completely hidden from the IdP.

On Thu, Feb 23, 2012 at 11:17, Michael Parente
<michael.parente at stevens.edu> wrote:
> Hello all,
>
> I sent this out a couple of weeks ago but didn't get any responses so I
> figured I'd send it again in case it was missed. Any suggestions or
> assistance would be greatly appreciated.
>
> We are using LDAP user/pass authentication with Shibboleth IdP 2.3.5. We
> currently extract the password as an attribute for one specific internal SP
> using this code:
>
> <!-- Add password as attribute-->
> <resolver:AttributeDefinition id="password" xsi:type="Script"
> xmlns="urn:mace:shibboleth:2.0:resolver:ad">
> <resolver:AttributeEncoder xsi:type="SAML1String"
>         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>         name="urn:mace:dir:attribute-def:password" />
>
> <resolver:AttributeEncoder xsi:type="SAML2String"
>         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>         name="urn:oid:2.5.4.35"
>         friendlyName="password" />
> <Script>
> <![CDATA[
>
> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
>
> importPackage(Packages.edu.internet2.middleware.shibboleth.idp.authn.provider);
>            importPackage(Packages.java.io.*);
>
>         // Create new password attribute
>            password = new BasicAttribute("password");
>         // Get subject only if the session exists (to avoid smal1)
>            if( requestContext.getUserSession() )
>            {
>                 // Get Subject
>            userSubject = requestContext.getUserSession().getSubject();
>         // There are two PrivateSessions existed, only get class
> UsernamePasswordCredential
>            i =
> userSubject.getPrivateCredentials(edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordCredential).iterator();
>            while(i.hasNext()) {
>               credential = i.next();
>                   password.getValues().add(credential.getPassword());
>            }
>         }
>            ]]>
> </Script>
> </resolver:AttributeDefinition>
>
> This has worked fine for us over the past few years. Lately, however,
> whenever we restart the IdP we sometimes get the following error in
> idp-process.log:
>
> WARN
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition:153]
> - password unable to compile even though the scripting engine supports this
> functionality.
>
> This error happened in our old 2.1.5 IdP as well as the new 2.3.5 instance.
> It seems that the error shows up completely at random. Sometimes after a
> restart we don't get it at all, other times it will appear once and then not
> come back after another reboot, and other times we will have to keep
> restarting the IdP several times for it to not appear. When it does appear,
> though, SPs will be able to create valid sessions with the IdP, but no
> attributes will be released to any SP.
>
> Does anyone have an explanation as to why this error shows up at random or
> what is causing it?
>
> Thanks,
> Mike
> Stevens Institute of Technology
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered