My MFA script is clearing the list of requested attributes

Cantor, Scott cantor.2 at
Tue May 30 17:33:52 EDT 2017

> It is possible that *not* removing the context after the first run may be
> contaminating the second. That isn't exactly what I remembered it doing, and
> it's perhaps a bug, but it isn't all that important as long as you remove the first
> copy of the context, which you should do, and then it should be fine.

FWIW, I think that is in fact how it's coded to behave. If there's already an AttributeResolutionContext as an immediate child of the ProfileRequestContext/root, the "mainline" resolving attributes logic is reusing some of it, including the requested attribute IDs.

So it's not just a nicety to cleanup the copy created in the MFA script, it's mandatory, which is why I probably did it in my example, I just hadn't remembered.

If you're seeing it resolve the same attribute set, it's definitely not getting removed in your script.

-- Scott

More information about the users mailing list