IdPFilterRequirementScript always returns true

[Sara Hopkins]

Hey Brent,

OK, thanks, so it's looking as if the example code is wrong then. What I want to do is to check an LDAP attribute and use its value to determine which attributes (if any) should be released to the SP. The idea is to apply access restrictions at the IdP end to particular sets of resources for particular groups of students. Am I missing some better way of doing this, perhaps?

> Actually, more likely, you unconditionally invoked a method on something
> that was null in that call and it's throwing (the JavaScript equivalent
> of) a null pointer exception.  For example, perhaps there isn't actually
> a resolver attribute called "uid" present, so the get("uid") part
> returns null and then you illegally try and invoke a method on that.

Yup, I wondered if it might be that; it wasn't clear to me whether the attributes referred to in the documentation were LDAP attributes or resolver attributes. So I explicitly added a resolver attribute called "uid", which the logs say is definitely resolved. Still get the error.

> I meant to also ask whether there were any entries in the log prior to
> this.  This is just the profile handler reporting that the attribute
> resolver didn't return any attributes.  I imagine there's probably some
> detail earlier in the log as to why the resolver failed.  Might also try
> turning up the log level to DEBUG to see if you get anything there.

Logging already at TRACE level for edu.internet2.middleware.shibboleth. Nothing gets logged between it starting to evaluate the filter policy script and throwing the "Error resolving attributes" warning:

13:14:05.295 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy testSP is active for principal shopkins
13:14:05.305 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml1.AbstractSAML1ProfileHandler:483] - Error resolving attributes for principal 'shopkins'.  No name identifier or attribute statement will be included in response

Cheers,

Sara
-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.