Activation Condition Predicate for an Empty Attribute

[Domingues, Michael D]

Hi All,


I'm currently attempting to write an Activation Condition predicate to test if an attribute is empty. The approach that I've taken, modeled off the documentation [1] is to wrap a wildcard SimpleAttributePredicate in a NOT condition like so:

<!-- Ensure that mail is not already populated -->
<bean parent="shibboleth.Conditions.NOT">
  <constructor-arg>
    <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
      <property name="attributeValueMap">
        <map>
          <entry key="mail">
            <list>
              <value>*</value>
            </list>
          </entry>
        </map>
      </property>
    </bean>
  </constructor-arg>
</bean>

Unfortunately, in so doing, I discovered that SimpleAttributePredicate wildcarding returns true, even for empty attributes (that get pulled out of the connected data source as EmptyAttributeValue objects). This seems like a bug to me, and I've filed a report here [2].


As a stop-gap, does anybody have a good approach (outside of writing a custom predicate bean myself) to return true only if an attribute is empty or non-existent?


Many thanks in advance,

Michael

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions

[2] https://issues.shibboleth.net/jira/browse/IDP-1206

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170810/96b2448e/attachment.html>