Activation Condition Predicate for an Empty Attribute

[Domingues, Michael D]

Hi Martin,

Thanks for that. I had a solution like that drafted yesterday, but eventually decided to just resolve it upstream by altering the SQL view definition to sub in the appropriate value before it even gets to the IdP.

Michael
________________________________
From: Martin Lunze <martin.lunze at tu-dresden.de>
Sent: Friday, August 11, 2017 12:15:52 AM
To: Domingues, Michael D
Cc: Shib Users
Subject: Re: Activation Condition Predicate for an Empty Attribute


Hi Michael,


maybe it's a possible alternative to solve this problem with a scripted attribute-definition like that?


        <Script>
            <![CDATA[
                if (typeof your-other-attr !== "undefined" && your-other-attr.getValues().size() > 0) {
                    mail.addValue(your-other-attr.getValues().get(0));
                } else {
                    mail.addValue("some-special-value");
                }
            ]]>
        </Script>


With nice regards

Martin

On 10.08.2017 18:01, Domingues, Michael D wrote:

Hi All,


I'm currently attempting to write an Activation Condition predicate to test if an attribute is empty. The approach that I've taken, modeled off the documentation [1] is to wrap a wildcard SimpleAttributePredicate in a NOT condition like so:

<!-- Ensure that mail is not already populated -->
<bean parent="shibboleth.Conditions.NOT">
  <constructor-arg>
    <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
      <property name="attributeValueMap">
        <map>
          <entry key="mail">
            <list>
              <value>*</value>
            </list>
          </entry>
        </map>
      </property>
    </bean>
  </constructor-arg>
</bean>

Unfortunately, in so doing, I discovered that SimpleAttributePredicate wildcarding returns true, even for empty attributes (that get pulled out of the connected data source as EmptyAttributeValue objects). This seems like a bug to me, and I've filed a report here [2].


As a stop-gap, does anybody have a good approach (outside of writing a custom predicate bean myself) to return true only if an attribute is empty or non-existent?


Many thanks in advance,

Michael

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions

[2] https://issues.shibboleth.net/jira/browse/IDP-1206





--
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Prozessmanagement und Controlling (PMC)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de<mailto:martin.lunze at tu-dresden.de>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170811/262d76fe/attachment-0001.html>