Prevent resolving all attributes?

[Zmuda, Matthew R]

Got it. That makes sense. Thanks for clearing that up.

I guess the issue then is that I am using resolver:AttributeDefinition xsi:type="Script"
Which encounters an error since data is not avaiable for both SP's but they attempt to resolve anyways.
Just need to add some error handle for this then.

Thanks again.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, January 30, 2013 10:59 AM
To: users at shibboleth.net
Subject: Re: Prevent resolving all attributes?

* Zmuda, Matthew R <Matthew.R.Zmuda at td.com> [2013-01-30 16:46]:
> 10:20:39.409 - ERROR 
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provide
> r.attributeDefinition.ScriptedAttributeDefinition:135] - 
> ScriptletAttributeDefinition paramName unable to execute script
> 10:20:39.410 - WARN 
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2Pr
> ofileHandler:478] - Error resolving attributes for principal ' XYZ123 
> '.  No name identifier or attribute statement will be included in 
> response
> 
> Is there anything I can do about this? I don't want to release these 
> values to our existing SP, that is what I have the rule set out in 
> attribute-filer.

What you release is independent from the ERROR above.

> I would expect if no attributes are requested, none should be resolved 
> rather than if none are requested all try to resolve.

That is not how the IdP works today (thouch some have seriously twisted their config to allow for that; check the archives if you want).
The current IdP always resolves everything and then releases what should be released. Unless your data sources have massive availablility problems this is not really an operational issue.
-peter

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.
AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.