shibboleth.c14n.attribute.PrincipalNameLookupStrategy bean

[Andrew Morgan]

On Thu, 16 Feb 2017, Cantor, Scott wrote:

> On 2/15/17, 7:28 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>> I can redo the example with that approach.
>
> I winged it a bit, if you can review/test the example and see what's 
> broken, that would help. The example script should be Nashorn safe now 
> and I think it's correct or close at least.
>
> The resolver part is basically gone, the idea behind this is that all 
> you're doing is normal resolver logic against 
> resolutionContext.principal like you would in the normal case.
>
> I cache my LDAP results for a bit of time, so even if it resolves 
> attributes multiple times in a request, the LDAP part is only done once. 
> Easy to monitor on DEBUG if one is paranoid about it.

Hmmm, I made the changes, but I get the following error after entering my 
credentials:

2017-02-15 17:13:57,776 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'morgan' succeeded
2017-02-15 17:13:58,398 - ERROR [net.shibboleth.idp.profile.context.navigate.ScriptedContextLookupFunction:163] - Scripted Function from Inline: Error while executing Function scriptjavax.script.ScriptException: ReferenceError: "net" is not defined in <eval> at line number 3
         at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:470)
Caused by: jdk.nashorn.internal.runtime.ECMAException: ReferenceError: "net" is not defined
         at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)


I think line 3 refers to this line:

var princs = subject.getPrincipals(Java.type(net.shibboleth.idp.authn.principal.UsernamePrincipal));


BTW, you should remove:

   <resolver:Dependency ref="searchUsername" />

from the attribute-resolver.xml data connector example.

Thanks,
 	Andy