error from eduPersonScopedAffiliation in IDP 3.1.2

[Rob Ansaldo]

> On Sep 1, 2015, at 8:57 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 9/1/15, 4:56 PM, "users on behalf of Rob Ansaldo" <users-bounces at shibboleth.net on behalf of rlansaldo at amherst.edu> wrote:
> 
> 
>> 
>> Is there a workaround for this? How would one filter this out? I have the same problem with a custom scoped attribute I am deriving from a relational database data connector. Not all of my users have this attribute set. Doesn’t seem to matter if the attribute is NULL or an empty string, still get the following error:
> 
> It's already patched (I believe). There's not much else we can do right now, there's too much else under active development.
> 
> If you're using a relational connector, you shouldn't have much trouble working around this. I think you could wrap the column in an isnull() expression to turn the nulls into a some fixed constant, and filter out that constant in your where clause or the mappings later on (maybe use a Mapped definition to transform things)
> 
> It's LDAP where this becomes a hassle, you would essentially have to create a Scripted attribute on top of the original data to filter out the empty values.
> 
> -- Scott
> 
>> 

Scott, thank you for the ideas here - I have tested the following and it appears to solve the issue for us.

Modify the SQL query used to derive the attribute using the COALESCE function, something like this:

<![CDATA[
  SELECT COALESCE(myAttribute, ‘NONE’) AS myAttribute FROM table WHERE uid = ‘${requestContext.principalName}’
]]> 

this substitutes the string NONE where the user has a NULL for this particular attribute - this keeps the error from occurring since it is no longer empty. Then to keep the NONE from being released, add an attribute filter policy to block the release if it is set to NONE:

    <AttributeFilterPolicy id="suppressNONE”>

      <PolicyRequirementRule xsi:type="basic:AttributeValueString"
        attributeID=“myAttribute"
        value="NONE" />

      <AttributeRule attributeID=“myAttribute">
        <DenyValueRule xsi:type="basic:ANY" />
      </AttributeRule>

      <AttributeRule attributeID=“otherAttributeBasedOnmyAttribute">
        <DenyValueRule xsi:type="basic:ANY" />
      </AttributeRule>

    </AttributeFilterPolicy>