template attribute definition possible bug?

[Athanasios Douitsis]

Hello all,

Responding to both Rod and Jeff.

I did some digging today and tried to put two single dependency templates
in front of the mapped attrs and then feed the final template with the
single templates. I was kind of hoping that this would make a difference,
unfortunately it didn't.

However, I noticed that whatever source attribute name I ask from a
dependency, I always get the same value which is the value of the
dependency. Meaning:

    <resolver:AttributeDefinition xsi:type="Template"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        id="testing">
        <resolver:Dependency ref="template1" />
        <Template>
                  <![CDATA[${whatever}:${template1}]]>
                </Template>
        <SourceAttribute>whatever</SourceAttribute>
        <SourceAttribute>template1</SourceAttribute>
    </resolver:AttributeDefinition>

Something like the above actually works and produces val1:val1 where val1
is the value of template1. So basically, this explains why I cannot use two
dependencies at the same time. It would seem that there's something to the
effect that the template cannot tell which source attribute comes from
where, so first time it gets all values from the first dependency, second
time from the second and so on.

By the way, I tried your gist, I still get wrong results. IdPv2 mind you.
The tests are being run with aacli and openjdk8 in case that matters. I
think we can rule the LDAP problem, right?

        <saml2:AttributeValue
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">A2V1:A2V1</saml2:AttributeValue>
        <saml2:AttributeValue
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">a1v1:a1v1</saml2:AttributeValue>
        <saml2:AttributeValue
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">a1v2:a1v2</saml2:AttributeValue>
        <saml2:AttributeValue
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">A2V2:A2V2</saml2:AttributeValue>


Kind regards,
Athanasios


On Tue, Nov 3, 2015 at 4:00 PM, Krug, Jeff <Jeff.Krug at gtri.gatech.edu>
wrote:
>
> Based on my reading of mapped and your data set below (I added an
attribute encoder so I could get the on the wire result), I got what I
would have expected with OpenJDK:
>
> <saml2:Attribute Name="TestAttribute"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml2:AttributeValue>a1v2:A2V2</saml2:AttributeValue>
> <saml2:AttributeValue>a1v1:A2V1</saml2:AttributeValue>
> </saml2:Attribute>
>
> If mapped was supposed to remove the V2s, then maybe there is a bug with
OpenJDK.  Otherwise, it sounds like if there is a bug it's somehow in the
LDAP configuration (or LDAP itself).
>
>
> ________________________________________
> From: users <users-bounces at shibboleth.net> on behalf of Rod Widdowson <
rdw at steadingsoftware.com>
> Sent: Tuesday, November 3, 2015 6:04 AM
> To: 'Shib Users'
> Subject: RE: template attribute definition possible bug?
>
> So there must be one of two things going on:
>
> 1) Either there is a bug (somewhere in something) or
> 2) We have not documented something clearly enough
>
> I have tried an obvious reproducer ((http://tinyurl.com/ovjdjon - this
> redirects to svn.shibboleth.net)
>
> And seen exactly what I (and you) would expect to have seen.
>
> You might like to try this example and see what it does for you (which
might
> help us to rule out OpenJDK).
>
> If you can you generate a stand along reproducer either using the static
> data connector or (if absolutely required) with a cut down ldif file and
put
> them into a JIRA case (or mail me back channel) I'll dig into it as best I
> can.
>
> One question I do have, you said:
>
> > My main problem with the Template is that the source attributes must all
> exist and be equal number. So I cannot
> > use the ldap connector to feed it directly, if the attribute in use is
not
> guaranteed to exist.
>
> Can you expand with what your data looks like and how you are using the
> "mapped" definition to align the counts?  Do you have null values coming
> back from the LDAP ?
>
> Thanks
> /Rod
>
>
>
> --
> To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net




--
Athanasios Douitsis
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151103/c9c3a44b/attachment.html>