Can an intercept trigger a re-resolution of attributes?

[Christopher Bongaarts]

On 8/3/2016 1:23 PM, Cantor, Scott wrote:
> The one that matters is the AttributeContext, but you should delete
> both. It's removeSubcontext.
>
> If you use the action beans I think it might remove the resolution
> context for you, but that isn't where the attributes are stored.

It looks like the action bean creates its own temporary resolution 
context if needed, and deletes it after resolution.

I tried this and it doesn't seem to work (no complaints/errors, but no 
effect - the resolver picks up the new value from LDAP, but my regex 
predicate still finds the old value).

         <evaluate 
expression="opensamlProfileRequestContext.removeSubcontext(T(net.shibboleth.idp.attribute.context.AttributeContext))"/>
         <evaluate 
expression="opensamlProfileRequestContext.removeSubcontext(T(net.shibboleth.idp.attribute.resolution.context.AttributeResolutionContext))"/>

> This is why it's better to put them in a private context location, so
> any interference is only you stepping on yourself. It's worth defining a
> single Java class to get that isolation.

I'm starting to wonder if I need to do something within the regex 
predicate (which is basically just the abstract attribute predicate with 
the match method overridden to check regex instead of the string map).


-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%