IdPFilterRequirementScript always returns true

[Brent Putman]

On 2/29/12 8:24 AM, Sara Hopkins wrote:
> Hey Brent,
>
> OK, thanks, so it's looking as if the example code is wrong then. 

Yes, it is.  I'll go in and fix up the wiki page, it really needs to
distinguish between usage of a script as a PolicyRequirementRule vs.
Permit-/DenyValueRule.

> What I want to do is to check an LDAP attribute and use its value to determine which attributes (if any) should be released to the SP. The idea is to apply access restrictions at the IdP end to particular sets of resources for particular groups of students. Am I missing some better way of doing this, perhaps?

Glad you got it working a different way with Peter's suggestion.


> Yup, I wondered if it might be that; it wasn't clear to me whether the attributes referred to in the documentation were LDAP attributes or resolver attributes. So I explicitly added a resolver attribute called "uid", which the logs say is definitely resolved. Still get the error.

Well, not sure what it was but there must be something wrong somewhere,
perhaps a typo or an invalid method call or something like that.


> Logging already at TRACE level for edu.internet2.middleware.shibboleth. Nothing gets logged between it starting to evaluate the filter policy script and throwing the "Error resolving attributes" warning:
>
> 13:14:05.295 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy testSP is active for principal shopkins
> 13:14:05.305 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml1.AbstractSAML1ProfileHandler:483] - Error resolving attributes for principal 'shopkins'.  No name identifier or attribute statement will be included in response


It occurred to me that perhaps the the JSR-223 scripting engine
components themselves might be logging something.  That would be a
different logging category than our shibboleth one, 'javax.script'.