HttpClient in Scripted Attribute Example

[Klingenstein, Nate]

> I suppose you could do something with the java.net.URL class to do something simple, perhaps.

It's trivial to do this with no safety netting.  Failures of various types appear to display a frank 500 error to the browser without taking down the IdP, making this appear innocuous.

Does anyone know how dangerous is this in reality?

	<AttributeDefinition xsi:type="ScriptedAttribute" id="createUserInADForvIDM">
		<Dependency ref="calstateEduPersonID"/>
		<Script><![CDATA[
logger = Java.type("org.slf4j.LoggerFactory").getLogger("edu.calstate.co.idm.vidm.createUserInADForvIDM");
urlType = Java.type("java.net.URL");
var url = "https://iam.calstate.edu/provision.aspx?cepid=" + calstateEduPersonID.getValues().get(0);
urlTyped = new urlType(url);
urlTyped.openStream();
logger.debug("User provisioned at URL: {} ", url);
		]]></Script>
	</AttributeDefinition>