My MFA script is clearing the list of requested attributes

[Wessel, Keith]

And that solved it! I didn't realize the importance of that call to remove the subContext. It was being created outside of the if-block but removed inside the if-block... which wasn't too bright on my part.

All of the logic used to be inside the if-block which is probably why I didn't have problems with this when I originally deployed the MFA flow. The resCtx variable was being initialized and removed inside that block.

Thanks, Scott, and sorry I didn't see this sooner.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, May 30, 2017 4:34 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: My MFA script is clearing the list of requested attributes

> It is possible that *not* removing the context after the first run may be
> contaminating the second. That isn't exactly what I remembered it doing, and
> it's perhaps a bug, but it isn't all that important as long as you remove the first
> copy of the context, which you should do, and then it should be fine.

FWIW, I think that is in fact how it's coded to behave. If there's already an AttributeResolutionContext as an immediate child of the ProfileRequestContext/root, the "mainline" resolving attributes logic is reusing some of it, including the requested attribute IDs.

So it's not just a nicety to cleanup the copy created in the MFA script, it's mandatory, which is why I probably did it in my example, I just hadn't remembered.

If you're seeing it resolve the same attribute set, it's definitely not getting removed in your script.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net