Connector Dependencies

[Mr. Christopher Bland]

Hi All,

I am running IDP v2.4.2. I have a AD connector (ADgroupLDAP) that depends on attribute (distinguishedName) and another AD connector (ADfduPerson) in my attribute-resolver.xml file  My config is based on the Generate eduPersonAffiliation based on recursive group membership in Active Directory on https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples

<resolver:AttributeDefinition id="distinguishedName" xsi:type="ad:Simple" sourceAttributeID="distinguishedName”> 
	<resolver:Dependency ref="ADfduPerson" />  
</resolver:AttributeDefinition>

<resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple" sourceAttributeID="distinguishedName”> 
	<resolver:Dependency ref="ADgroupLDAP" />
 </resolver:AttributeDefinition>

    <resolver:DataConnector id="fduEmployeeLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldaps://old_ldap_server:636"
        baseDN="dc=baseDN"
        principal=“adminuser"
        principalCredential=“Password"
        >
        <FilterTemplate>
            <![CDATA[
                (mail=$requestContext.principalName)
            ]]>
        </FilterTemplate>
    </resolver:DataConnector>

    <resolver:DataConnector id="ADfduPerson" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldaps://adsever1.fdu.edu:3269 ldaps://adserver2.fdu.edu:3269"
        baseDN=“dc=baseDN”
	principal=“adminuser at addomain"
        principalCredential=“Password"
        >
        <FilterTemplate>
            <![CDATA[
                (userPrincipalName=$requestContext.principalName)
            ]]>
        </FilterTemplate>
    </resolver:DataConnector>

	<resolver:DataConnector id="ADgroupLDAP" xsi:type="dc:LDAPDirectory"
        	ldapURL="ldaps://adsever1.fdu.edu:3269 ldaps://adserver2.fdu.edu:3269"
        	baseDN=“dc=baseDN"
        	principal="adminuser at addomain"
        	principalCredential=“Password"
		maxResultSize="1000"
		mergeResults="true"
		searchTimeLimit="PT10.000S"
		>

		<resolver:Dependency ref="ADfduPerson" />
		<resolver:Dependency ref="distinguishedName" />
		<dc:FilterTemplate>
			<![CDATA[
				(member:1.2.840.113556.1.4.1941:=${distinguishedName.get(0)})
			]]>
		</dc:FilterTemplate>
		<dc:ReturnAttributes>distinguishedName</dc:ReturnAttributes>
                <dc:LDAPProperty name="java.naming.referral" value="follow"/>
	</resolver:DataConnector>

I am migrating from an LDAP server to AD and as such have some older users who are not in AD.  What I have noticed is that for users that are only in the old LDAP server I get the following error

2015-10-05 20:18:14.999 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute distinguishedName containing 0 values
2015-10-05 20:18:15.007 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.TemplateEngine:100] - Unable to populate shibboleth.resolver.dc.ADgroupLDAP template
org.apache.velocity.exception.MethodInvocationException: Invocation of method 'get' in  class java.util.ArrayList threw exception java.lang.IndexOutOfBoundsException: Index: 0, Size: 0 at shibboleth.resolver.dc.ADgroupLDAP[line 1, column 54]
        at org.apache.velocity.runtime.parser.node.ASTMethod.handleInvocationException(ASTMethod.java:243) ~[velocity-1.7.jar:1.7]
        at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:187) ~[velocity-1.7.jar:1.7]
        at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:280) ~[velocity-1.7.jar:1.7]
        at org.apache.velocity.runtime.parser.node.ASTReference.render(ASTReference.java:369) ~[velocity-1.7.jar:1.7]
        at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:342) ~[velocity-1.7.jar:1.7]
        at org.apache.velocity.Template.merge(Template.java:356) ~[velocity-1.7.jar:1.7]
        at org.apache.velocity.Template.merge(Template.java:260) ~[velocity-1.7.jar:1.7]

2015-10-05 20:18:15.008 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:379] - Received the following error from data connector ADgroupLDAP, no failover data connector available
edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException: Unable to evaluate template
        at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.TemplateEngine.createStatement(TemplateEngine.java:101) ~[shibboleth-common-1.4.2.jar:na]


This error prevents any attributes from being returned for the user even though they are found in the old LDAP server and have valid attributes for the requested service.  My understanding of Dependency is that if the ADfduPerson and distinguishedName are not resolved this connector should be ignored.

-Chris