IdPFilterRequirementScript always returns true

[Brent Putman]

On 2/28/12 12:14 PM, Sara Hopkins wrote:
> Many thanks Brent for this and your earlier reply. I've done some 
> experimentation along the lines you suggest, and it appears that both 
> attributeId and attributeValue indeed are null, and so the conditionals 
> (or at least, the first of them) are responsible for the return value of 
> "true". So why would they be null?


Ah, ok, I see.  In looking back at your original example, I notice that
you are using the script as a PolicyRequirementRule.  In looking at the
code for the script filter functor:

http://svn.shibboleth.net/view/java-shib-common/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/attribute/filtering/provider/match/basic/ScriptMatchFunctor.java?revision=982&view=markup


I see that attributeId and attributeValue are indeed set to null by
intention when it is invoked as a PolicyRequirementRule.  They only take
take values when they are used as an AttributeRule.  I'm not super
familiar with the filtering engine internals, but I guess that makes
sense, since when it's the former there's probably not a specific
attribute or value being evaluated at that point.  It's used to
determine whether the subordinate attribute rules should fire.

The example in the wiki clearly does purport to document a
PolicyRequirementRule and since the code says otherwise, I'd wager the
wiki example is just wrong, both on those conditionals and the attribute
value calls access I earlier pointed out.  I suppose it's also possible
the code is wrong, but I'll Chad or someone more familiar with the
filter engine confirm, since I don't work in the filter engine that much.
  

>
> The documentation says "the ID of the attribute currently being 
> evaluated is bound to a script attribute called attributeId, the current 
> attribute value being evaluated is bound to a script attribute called 
> attributeValue". I'm not sure what this means. Is it referring to the 
> "uid" attribute in my example? Why would attributeId and attributeValue 
> be null? There is an attribute called "uid" in my LDAP.

No, it's referring to the attribute id and value that would be
evaluated, if the script were being used in an AttributeRule.  Nothing
to do with your uid attribute.  There, the rule gets called once for
each value, for each attribute, that was in the resolved set (assuming
the rule fires at all, based on whether the PolicyRequirementRule was
true or not)

>
> If I remove the two "if statements" from the script then I get a WARN 
> message in the log:
>
> 16:52:38.439 - WARN 
> [edu.internet2.middleware.shibboleth.idp.profile.saml1.AbstractSAML1ProfileHandler:483] 
> - Error resolving attributes for principal 'shopkins'.  No name 
> identifier or attribute statement will be included in response
>
> I guess that's consistent with it trying to "get" a null attribute, but 
> I still don't see why it would be null.

Yeah, not sure about that probably some other subtle syntactic error you
introduced. I don't think that the script should error out because the
conditionals are taken out.  They are completely unrelated to whatever
you are doing by accessing things from the filter context.

Actually, more likely, you unconditionally invoked a method on something
that was null in that call and it's throwing (the JavaScript equivalent
of) a null pointer exception.  For example, perhaps there isn't actually
a resolver attribute called "uid" present, so the get("uid") part
returns null and then you illegally try and invoke a method on that.

--Brent