Debugging scripted attributes?

[Losen, Stephen C. (scl)]

Hi folks,

This is IDP v 3.2.1

I had a subtle bug in a scripted attribute where I unconditionally did attr.getValues.get(0) without first ensuring attr.getValues().size() > 0.

I had a hard time tracking this down.  In the idp-process.log file with INFO level logging, I only got this:

2016-11-30 00:00:24,155 - ERROR [net.shibboleth.idp.saml.profile:-1] - Uncaught runtime exception
java.lang.IndexOutOfBoundsException: Index: 0, Size: 0
    at java.util.ArrayList.rangeCheck(ArrayList.java:653)

No more stack trace, and no indication that the exception was caused by an attribute script, let alone which line number.

I increased logging to DEBUG and got a lot more information leading up to the error, but the error itself was the same, still unhelpful.  Immediately before the error, however, the debug info mentioned the LDAP attribute.  So I looked for that attribute in my attribute-resolver.xml file.  I found it in numerous places, including the attribute script.  Eventually I figured out the problem.

So I am wondering how other folks detect problems in attribute scripts and debug them.  Can I set something in logback.xml ?

In this particular case, the scripted attribute depends on a LDAP attribute that "normally" has a value, so attribute release works fine for most folks.  But a few folks do not have this LDAP attribute, so they get cryptic errors from the IDP (essentially, IDP failed due to uncaught exception).  I was trying to track this down.

Also, it seems a bit harsh to completely derail attribute release for a script error like this.  Couldn't it be handled a bit more gracefully?  Perhaps just bail on the attribute that the script is defining, but continue the release process? 

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640