Activation Condition Predicate for an Empty Attribute

[Domingues, Michael D]

> > Unfortunately, in so doing, I discovered that SimpleAttributePredicate

> > wildcarding returns true, even for empty attributes (that get pulled out of
> > the connected data source as EmptyAttributeValue objects). This seems like
> > a bug to me, and I've filed a report here [2].

> I think it's a limitation and documentation issue at this point vs.a  bug but that's semantics.

Looking at the test case slightly differently, the current behavior means (in effect) that at least when using a RDBMS connector, a wildcard test will return true on any attribute, period, so long as that attribute is included in the query against the underlying table / view. I won't argue the semantics of what to call it, but that seems to render wildcard matching (for RDBMS connections) useless.

> > As a stop-gap, does anybody have a good approach (outside of writing a
> > custom predicate bean myself) to return true only if an attribute is empty or
> > non-existent?

> The general rule is that you're not really wanting to surface empty values outside the resolver, which I was under the mistaken idea we were actually preventing. So certainly not exposing them is one way > around it, but that's just moving the custom script logic into the resolver vs. inside a custom predicate script.

Backing up and being a bit more specific about my use case, I'd like to use an activation condition on a secondary definition of the mail attribute, if and only if the regular mail attribute is empty and a separate additional condition is met.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170810/2690085a/attachment-0001.html>