Can an intercept trigger a re-resolution of attributes?

[Christopher Bongaarts]

On 8/1/2016 6:04 PM, Cantor, Scott wrote:
>> Both of these sound to me like I should be using some sort of temporary
>> >attribute context within the intercept, but I'm not quite sure where it
>> >should go in the Giant Context Tree, or how to specify it (perhaps
>> >defining more shibboleth.ChildLookup(orCreate) beans).
> p:setAttributeContextCreationStrategy-ref=
> "shibboleth.ChildLookupOrCreate.AttributeContext"
>
> I don't know where you could really put it that's appropriate, but
> ironically putting it directly under the root is not actually going to
> conflict, the official attributes are left under the
> RelyingPartyContext. Which the above should do.

When I try using this, it will correctly find the password status, but 
on subsequent iterations of the loop, it doesn't pick up the changes.  I 
can see the resolver find the new value:

2016-08-03 12:55:10,013 - DEBUG 
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247] 
- Attribute Definition 'umnPasswordStatus': produced an attribute with 
the following values [StringAttributeValue{value=Q}]
2016-08-03 12:55:10,014 - DEBUG 
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272] - 
Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 
'umnPasswordStatus' produced an attribute with 1 values
2016-08-03 12:55:10,014 - DEBUG 
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:201] - 
Attribute Resolver 'ShibbolethAttributeResolver': Finalizing resolved 
attributes
2016-08-03 12:55:10,014 - DEBUG 
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:434] - 
Attribute Resolver 'ShibbolethAttributeResolver': De-duping attribute 
definition umnPasswordStatus result
2016-08-03 12:55:10,014 - DEBUG 
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:446] - 
Attribute Resolver 'ShibbolethAttributeResolver': Attribute 
'umnPasswordStatus' has 1 values after post-processing

but it either doesn't get saved in the context, or the existing value is 
not removed:

2016-08-03 12:55:10,015 - DEBUG 
[edu.umn.oit.idm.shib.RegexAttributePredicate:76] - Checking for 
attribute: umnPasswordStatus
2016-08-03 12:55:10,015 - DEBUG 
[edu.umn.oit.idm.shib.RegexAttributePredicate:87] - Found matching value 
(XI) in attribute umnPasswordStatus

Is there a way to easily delete an existing subcontext from the flow?  
something like

<evaluate 
expression="opensamlProfileRequestContext.removeContext(AttributeResolutionContext.class">

(will try that now....)

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160803/05fe6df4/attachment.html>