Debugging scripted attributes?

[Peter Schober]

* Losen, Stephen C. (scl) <scl at eservices.virginia.edu> [2016-11-30 15:46]:
> The script generates an attribute called "authService" which is a
> list of services that the user is authorized to use (such as BOX or
> various software download services or Qualtrics, etc.)  The logic is
> very complicated involving numerous LDAP attributes.  And each
> service has its own rather convoluted rules.

JFYI, in similar cases (and back then when I was in charge of local
IDM for my employer) I opted to do these things further upstream and
e.g. "calculate" and enumerate allowed services in multi-valued LDAP
attributes. I.e., the programming and logic would happen elsewhere,
with the upside that the information is also easily available to other
systems, not just the Shib IDP. That in turn means you can use the
info for reporting or IT support/helpdesk requests since they will
invariably need to find out why someonne was/wasn't able to log in.
-peter