attribute resolver script

[Michael Dahlberg]

I'm trying to populate an attribute, eduPersonPrimaryAffiliation, from
another attribute that I have available in our LDAP structure,
bucknellEduPersonPrimaryAffiliation.  Normally, I'd just release
bucknellEduPersonPrimaryAffiliation and be done with it.  Unfortunately,
the SP requires a valid value in the attribute and there are a number of
entries in our LDAP structure for this attribute that have no value (or a
"not real valid" value).  Based on this I tried writing the following
resolver script:

    <resolver:AttributeDefinition id="eduPersonPrimaryAffiliation"
                                  xsi:type="ad:Script">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5"
friendlyName="eduPersonPrimaryAffiliation" />

   <ad:Script><![CDATA[
        // If the user has group membership
        if (typeof eduPersonAffiliation != "undefined" ){
            value = bucknellEduPersonPrimaryAffiliation.getValues();

            if (value.contains("faculty")){
                strPrimary = "faculty";
            } else if (value.contains("staff")){
                strPrimary = "staff";
            } else if (value.contains("student")){
                strPrimary = "student";
            } else if (value.contains("alum")){
                strPrimary = "alum";
            } else {
                strPrimary = "member";
            }
        }
        eduPersonPrimaryAffiliation.add(strPrimary);
        ]]></ad:Script>

    </resolver:AttributeDefinition>


The IdP starts fine, but when I try and release the attribute
eduPersonPrimaryAffiliation, the script tries adding a number of attributes
(uid, telephoneNumber, mail, etc) to eduPersonPrimaryAffiliation (as a
"dependent attribute", which they are clearly not) as well as the attribute
retrieved from bucknellEduPersonPrimaryAffiliation and ultimately errors
out with the error:

14:57:45.050 - ERROR
[net.shibboleth.idp.profile.impl.ResolveAttributes:257] - [134.82.79.6] -
Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute
Definition 'eduPersonPrimaryAffiliation': unable to execute script

Any suggestions will be greatly appreciated.

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161108/8b415a27/attachment.html>