error in attribute resolver after upgraded to IDP 3.0

[Hong Ye]

Thanks Rod. I can’t change the name in attributeEncoder because that is the name Vendor required. Instead I changed the sourceAttributeID that resolved the error. Now I got this  error when ran aacli.sh


2015-01-14 13:45:21,678 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:233] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'skillsoftdeptNumber': unable to execute script
        at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition.doAttributeDefinitionResolve(ScriptedAttributeDefinition.java:152)
Caused by: javax.script.ScriptException: ReferenceError: "importPackage" is not defined in <eval> at line number 1
        at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:586)
Caused by: jdk.nashorn.internal.runtime.ECMAException: ReferenceError: "importPackage" is not defined
        at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:58)


I also see this warning in the log. The warning was generated when I restarted Tomcat. I don’t understand what it mean.
2015-01-14 13:43:43,920 - WARN [net.shibboleth.idp.saml.attribute.mapping.AbstractSAMLAttributeMapper:223] - Scoped Attribute Mapper 'MapperForeduPersonScopedAffiliation': Attribute 'urn:oid:1.3.6.1.4.1.5923.1.1.1.9' value conversion yielded no suitable values

>From attribute-resolver.xml
<resolver:AttributeDefinition id="skillsoftdeptNumber" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              xsi:type="Script"
                              sourceAttributeID="uid">

    <resolver:Dependency ref="myLDAP" />

    <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="skillsoftdept"
                               friendlyName="dept name for skillsoft"
                               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" />

    <Script><![CDATA[

       importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

        // Create attribute to be returned from definition
        skillsoftdept = new BasicAttribute("skillsoftdept”);

        ...

    ]]></Script>

</resolver:AttributeDefinition>

<resolver:AttributeDefinition id="eduPersonScopedAffiliation"
        xsi:type="Scoped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        scope="%{idp.scope}" sourceAttributeID="eduPersonAffiliation">

        <resolver:Dependency ref="myLDAP" />

        <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString"
            name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
            encodeType="false" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString"
            name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
            friendlyName="eduPersonScopedAffiliation"
            encodeType="false" />
</resolver:AttributeDefinition>


On Jan 14, 2015, at 1:21 PM, Rod Widdowson <rdw at steadingsoftware.com<mailto:rdw at steadingsoftware.com>> wrote:

Well that was exciting.  The trouble comes with the name for this encoder:

<resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
  name="skillsoftdept"
  friendlyName="dept name for skillsoft"
  nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" />

By giving it the name "skillsoftdept", you override the name of the
attribute "skillsoftdept".  So when the attribute resolver goes to resolve
the dependencies it say: "I don't see an attribute called skillsoftdept,
just this encoder".  Bang

Actually, I'm surprised that this worked in V2, but for now change that name
to something else and you should be all set.    I'll do a fuller analysis as
it why it worked in V2 and report back.   If I can find a way of removing
the regression we'll fix it.

Rod

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150114/76e4a957/attachment.html