IdPFilterRequirementScript always returns true

[Sara Hopkins]

I've just been testing the IdPFilterRequirementScript example here:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirementScript

and it always returns "true". Or at least, it always releases the eduPersonScopedAffiliation attribute. However, it should never return "true", or release the attribute, because the uid attribute exists in my LDAP exists and is not "aardvark".

Is this a bug, or am I doing something wrong? Here's the code I'm using:

    <afp:AttributeFilterPolicy id="testSP">
        <afp:PolicyRequirementRule xsi:type="basic:Script">
            <basic:Script>
                <![CDATA[
                    function evaluateRule(filterContext, attributeId, attributeValue) {
                        if (attributeId == null) return true;
                        if (attributeValue == null) return true;
                        return filterContext.getAttributeRequestContext().getAttributes().get("uid").equals("aardvark");
                    }
                    evaluateRule(filterContext, attributeId, attributeValue);
                ]]>
            </basic:Script>
        </afp:PolicyRequirementRule>
        <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

Thanks,

Sara
-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.