Prevent resolving all attributes?

[Peter Schober]

* Zmuda, Matthew R <Matthew.R.Zmuda at td.com> [2013-01-30 16:46]:
> 10:20:39.409 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition:135] - ScriptletAttributeDefinition paramName unable to execute script
> 10:20:39.410 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:478] - Error resolving attributes for principal ' XYZ123 '.  No name identifier or attribute statement will be included in response
> 
> Is there anything I can do about this? I don't want to release these
> values to our existing SP, that is what I have the rule set out in
> attribute-filer.

What you release is independent from the ERROR above.

> I would expect if no attributes are requested, none should be
> resolved rather than if none are requested all try to resolve.

That is not how the IdP works today (thouch some have seriously twisted their
config to allow for that; check the archives if you want).
The current IdP always resolves everything and then releases what
should be released. Unless your data sources have massive
availablility problems this is not really an operational issue.
-peter