scripted attribute definition produces a null attribute
Sean McHugh
sean8sean at gmail.com
Thu Oct 11 09:22:16 EDT 2012
Hi all,
I think I have the AttributeDefinition setup correctly, but for some reason
Shib is telling me i am producing a null attribute. The goal is to release
only a specific set of prefixed
group names to a certain relying party. We first take all of the values in
the memberOf attribute from AD via the LDAP connector, check for the
leading prefix match and then strip
out the CN value from the DN string; after that, we join it all together
into a comma separated list for the attribute value. When I run aacli.sh
for this (or any SP), it produces no output and instead I get this in the
logs (note: i'm logging inside the attribute definition to debug the
issue). At the bottom, i've posted the Attribute definition.
Any insights would be much appreciated.
thx
--- log ---
08:58:20.343 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:180] -
shibboleth.HandlerManager service loaded new configuration
08:58:20.344 - WARN
[edu.internet2.middleware.shibboleth.common.config.service.ServletContextAttributeExporter:74]
- This service may only be used when services are loaded within a web
application context.
08:58:20.453 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Retrieved
memberOf. size = 16
08:58:20.454 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=blogadmins,OU=Security Groups,OU=NYC,DC=thegalil
eoschool,DC=org
08:58:20.455 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=IT
NA,OU=Distribution Groups,OU=NYC,DC=thegalile
oschool,DC=org
08:58:20.455 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=GGG
- IT New York,OU=Distribution Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.456 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=NA-NYC1-Xinet Notifications,OU=Distribution
Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.457 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group
matched:NA-NYC1-Xinet Notifications
08:58:20.457 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=Web
Services,OU=Hidden Service DL,OU=Distributio
n Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.458 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=NetBackupAdmins,OU=Security Groups,OU=NYC,DC=the
galileoschool,DC=org
08:58:20.458 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=VPN-GGG,OU=Security Groups,OU=NYC,DC=thegalileos
chool,DC=org
08:58:20.458 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=Taleo Perform – managers,OU=Distribution Groups,
OU=NYC,DC=thegalileoschool,DC=org
08:58:20.460 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=zzzDearDavid-PleaseDisablePublicGroups,CN=Users,DC=thegalileoschool,DC=org
08:58:20.461 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=NA-NYC1-Dev-SG,OU=Security Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.461 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group
matched:NA-NYC1-Dev-SG
08:58:20.462 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=IT
Global Leadership,OU=Distribution Groups,OU=N
YC,DC=thegalileoschool,DC=org
08:58:20.462 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=dev,OU=Security Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.463 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] -
Group:CN=DavidLiuLovesPublicGroupsAndKittens,CN=Users,DC=thegalileoschool,DC=org
08:58:20.463 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] -
Group:CN=ThisIsAGroupWhereICanMakeUpAName,CN=Users,DC=thegalileoschool,DC=org
08:58:20.464 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] -
Group:CN=Group,OU=Distribution Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.465 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] -
Group:CN=NA-NYC1-Digitalteam_PVadmin,OU=Security
Groups,OU=NYC,DC=thegalileoschool,DC=org
08:58:20.466 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Group
matched:NA-NYC1-Digitalteam_PVadmin
08:58:20.466 - INFO
[edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Sending back
zonzagroups:NA-NYC1-Xinet Notifications,NA-N
YC1-Dev-SG,NA-NYC1-Digitalteam_PVadmin
08:58:20.467 - ERROR
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition
:129] - zonza-groups produced a null attribute
08:58:20.471 - ERROR
[edu.internet2.middleware.shibboleth.common.attribute.AttributeAuthorityCLI:392]
- Error encountered during attribute r
esolution and
filteringedu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException:
zonza-groups produced a null attributes
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition.doResolve(ScriptedAttributeDefinition.java:130)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:108)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:39)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ContextualAttributeDefinition.resolve(ContextualAttributeDefinition.java:93)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ContextualAttributeDefinition.resolve(ContextualAttributeDefinition.java:33)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttribute(ShibbolethAttributeResolver.java:335)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:284)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:131)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:174)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:58)
~[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.AttributeAuthorityCLI.performSAML2AttributeResolution(AttributeAuthorityCLI.java:261)
[shibboleth-common-1.3.5.jar:na]
at
edu.internet2.middleware.shibboleth.common.attribute.AttributeAuthorityCLI.main(AttributeAuthorityCLI.java:103)
[shibboleth-common-1.3.5.jar:na]
--- log ---
--- attribute-resolver.xml ---
<resolver:AttributeDefinition id="zonza-groups" xsi:type="Script"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
sourceAttributeID="memberOf">
<resolver:Dependency ref="myLDAP" />
<resolver:AttributeEncoder xsi:type="SAML1String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="
http://thegalileoschool.org/identity/zonza/zonza-groups" />
<resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="
http://thegalileoschool.org/identity/zonza/zonza-groups"
friendlyName="zonza-groups" />
<Script>
<![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
importPackage(Packages.org.slf4j);
logger =
LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.foo");
zonzagroups = new BasicAttribute("zonza-groups");
var ngroup = memberOf.getValues().size();
var grouplist = [];
var grpstr = "none";
logger.info("Retrieved memberOf. size = " + ngroup);
for(var i=0; memberOf != null && i < ngroup; i++) {
var group = memberOf.getValues().get(i);
logger.info("Group:" + group);
if(group.toLowerCase().indexOf("cn=na-") == 0) {
var re = /^cn=(.+?)\,/i;
var match = re.exec(group);
var grpname = match[1];
grouplist.push(grpname);
logger.info("Group matched:" + grpname);
}
}
if( grouplist.length > 0 ) {
grpstr = grouplist.join(",");
}
logger.info("Sending back zonzagroups:" + grpstr);
zonzagroups.getValues().add(grpstr);
]]>
</Script>
</resolver:AttributeDefinition>
--- attribute-resolver.xml ---
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121011/16afd415/attachment.html
More information about the users
mailing list