Debugging scripted attributes?

[Rod Widdowson]

> So I am wondering how other folks detect problems in attribute scripts and debug them.  Can I set something in logback.xml ?

There is a dent in the wall by my desk from where I have beaten my head against it chasing up equivalent issues.  There is nothing
that can be done to help you inside the IdP.

But..... Some kind soul documented, quite some time ago, how to add logging to your script[1], so you can use "printf debugging"
without having to debug the code to add debugging to your script.


[1]
https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition#ScriptedAttributeDefinition-LoggingWithinaScript

> Also, it seems a bit harsh to completely derail attribute release for a script error like this.  
> Couldn't it be handled a bit more gracefully?  Perhaps just bail on the attribute that the 
> script is defining, but continue the release process?

Nice idea but we couldn't make it "safe".  You might be using the presence of an attribute to disallow attribute release further
down the line and a failure (even with noise) could lead to information leakage.  

The general idea is that you debug the resolver script once (and that is painful) and then it works. If it fails in production n
that is serious and you need to know about it.

Sorry to not be more positive.