AttributePredicate Syntax

[Walter Forbes Hoehn (wassa)]

Ah, I had not noticed the various bean helpers in utilities.xml, that’s definitely good to know. Your off the cuff suggestion for injecting the AttributeContextLookupStrategy worked, with one simple modification.  For the record:

  <bean id=“DuoAttributeContextLookupStrategy" 
    class="com.google.common.base.Functions” 
    factory-method=“compose" 
    c:g-ref="shibboleth.ChildLookupOrCreate.AttributeContext” 
    c:f-ref="shibboleth.ChildLookup.SubjectCanonicalizationContext” />

Unfortunately, this overall strategy didn’t function as I’d hoped. Return attributes from LDAP AuthN were not revealed to the predicate:

  2016-02-10 10:26:53,425 - DEBUG - XX.XX.XX.XX - foo.memphis.edu - [net.shibboleth.idp.profile.logic.SimpleAttributePredicate:88] - Checking for attribute: uid
  2016-02-10 10:26:53,425 - INFO  - XX.XX.XX.XX - foo.memphis.edu - [net.shibboleth.idp.profile.logic.SimpleAttributePredicate:92] - Attribute uid not found in context

I’m running this predicate from a subflow of the the conditions subflow, so maybe the AuthenticationContext hasn’t been populated appropriately at that point.  I’ll have to dig a bit deeper.

The following SWF expression does work, although it is specific to our AuthN configuration and possibly a bit brittle:

  <evaluate expression="flowScope.authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext)).getAuthenticationResponse().getLdapEntry().getAttribute('uid').getStringValue()" />

 I guess I could just whip up a custom Predicate that pulls data similarly.

-WFH


> On Feb 9, 2016, at 7:38 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> Yes, I meant within SWF and associated beans. I had seen the constructor
>> you referred to in the previous email, but wasn’t sure how to inject that sort
>> of thing into the Predicate.
> 
> You wire up a composition of functions using Google's Functions class and the compose factory-method.
> 
> There are two beans already defined that do child lookup of AuthenticationContext and AttributeContext (see utilities.xml):
> 
> shibboleth.ChildLookup.AuthenticationContext
> shibboleth.ChildLookup.AttributeContext
> 
> You wrap those as the two constructor arguments to the compose method.
> 
> Totally untested, but I think you could do:
> 
>                            <bean class="com.google.common.base.Functions" factory-method="compose"
>                                c:g-ref="shibboleth.ChildLookup.AttributeContext"
>                                c:f-ref=" shibboleth.ChildLookup.AuthenticationContext" />
> 
> The best examples of this wiring are in audit-system.xml.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net