ScriptedAttribute AttributeResolver with java 1.8 - Nashorn vs. Rhino

[dennis.ahrens at hs-hannover.de]

Hi list,


I am trying to create a AttributeResolver in Shibboleth 3.3 on debian 8 using oracle java 1.8.0_112 inside of tomcat8. I want to achieve the evaluation of groups in an AD based LDAP to resolve the eduPersonScopedAffiliation.


When testing my configuration I see the following error in the idp-process.log:



ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:299] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'eduPersonAffiliation': unable to execute script
    at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition.doAttributeDefinitionResolve(ScriptedAttributeDefinition.java:190)
Caused by: javax.script.ScriptException: sun.org.mozilla.javascript.EcmaError: ReferenceError: "Java" is not defined. (<Unknown Source>#1) in <Unknown Source> at line number 1
    at com.sun.script.javascript.RhinoCompiledScript.eval(RhinoCompiledScript.java:64)
Caused by: sun.org.mozilla.javascript.EcmaError: ReferenceError: "Java" is not defined. (<Unknown Source>#1)
    at sun.org.mozilla.javascript.ScriptRuntime.constructError(ScriptRuntime.java:3687)



This is confusing, as I expect Nashorn to be included in java 1.8, but the IdP seems to refer to Rhino. Here is my current minimal AttributeResolver snip:



<AttributeDefinition id="eduPersonAffiliation" xsi:type="ScriptedAttribute">
        <Script><![CDATA[
scopedValueType =  Java.type("net.shibboleth.idp.attribute.ScopedStringAttributeValue");
var localpart = "foo";
eduPersonAffiliation.addValue(new scopedValueType(localpart, "%{idp.scope}"));
        ]]></Script>

        <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:eduPersonAffiliation" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
friendlyName="eduPersonAffiliation" encodeType="false" />
    </AttributeDefinition>



Do I need to install Nashorn manually in order to solve this? As far as I understand it is included in java 1.8 out of the box. Any hints are appreciated.


Regards

Dennis Ahrens
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161220/93aa1d4e/attachment.html>