Removing a value from an attribute in a script

[Cantor, Scott]

On 5/24/17, 6:00 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Anyway, is there a simple way to remove an attribute value from an attribute using the Nash scripting engine's allowed syntax in
> IdP v3? I was hoping for a removeValue or remove method, but that doesn't seem to work. Do I have to clear the list then add
> back what I want to have left?

Well, conceptually this is kind of a bad idea because I think to do this, by definition you're inside *another* attribute definition and trying to modify one of its dependencies. Otherwise this makes no sense because if you were inside a script building the attribute you wanted to modify then you obviously have control over this.

And you have a real ambiguity if you start changing attributes like this because now the value set will depend on the sequence of graph nodes in the resolver, and I think it's just not a good idea.

That said, I'm still on Rhino and I have only limited understanding of all the pieces, but I was just looking at the docs on this for something I'm working on, and I think what you want is the getNativeAttribute() call because that directly exposes the underlying IdPAttribute and its values. If you use the wrapped ScriptedAttribute the dependent attributes end up inside, that's a copy of the original values so it can't be modified.

Anyway, I wouldn't do it. If you need to do this, create a second attribute definition layered on the first.

-- Scott