Making DataConnector failure non-fatal

[Ian Bobbitt]

I have an HTTP DataConnector that fetches password expiration dates to run users through the ExpiringPassword interrupt.
This isn't enforcing any security policy, just giving users an additional warning.

Is there a way I can make failures on that DataConnector non-fatal, or provide a default if there's a failure? If the
webservice is unavailable, I get an error in the logs. The user is able to complete authentication, but the resulting
assertion contains no attributes.

2019-02-12 16:10:51,736 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:314] - Profile Action
ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'passwordExpiration': HTTP request failed
        at
net.shibboleth.idp.attribute.resolver.dc.http.impl.HTTPDataConnector.retrieveAttributes(HTTPDataConnector.java:109)
Caused by: org.apache.http.conn.ConnectTimeoutException: Connect to apihost:443 [apihost/192.0.2.1] failed: connect
timed out
        at
org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)
Caused by: java.net.SocketTimeoutException: connect timed out
        at java.net.PlainSocketImpl.socketConnect(Native Method)

    <DataConnector id="passwordExpiration" xsi:type="HTTP"
                   httpClientRef="passwordExpirationHttpClient"
                   httpClientSecurityParametersRef="passwordExpirationHttpSecurity">
        <URLTemplate>
            <![CDATA[
                https://apihost/passwordExpiration.cgi?username=$paramEscaper.escape($resolutionContext.principal)
            ]]>
        </URLTemplate>
        <ResponseMapping>
            <ScriptFile>%{idp.home}/conf/passwordExpiration.js</ScriptFile>
        </ResponseMapping>
        <ResultCache expireAfterWrite="PT5S"/>
    </DataConnector>
    <AttributeDefinition xsi:type="Simple" id="passwordExpiration">
        <InputDataConnector ref="passwordExpiration" attributeNames="DCpasswordExpiration" />
        <AttributeEncoder xsi:type="SAML2String" name="https://idp.example.edu/idp/passwordExpiration"
friendlyName="passwordExpiration" encodeType="false" />
    </AttributeDefinition>


var HashSet = Java.type("java.util.HashSet");
var HttpClientSupport = Java.type("net.shibboleth.utilities.java.support.httpclient.HttpClientSupport");
var IdPAttribute = Java.type("net.shibboleth.idp.attribute.IdPAttribute");
var StringAttributeValue = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");

var body = HttpClientSupport.toString(response.getEntity(), "UTF-8", 65536);
var result = JSON.parse(body);
//log.info(body);
//log.info(result);
var attr = new IdPAttribute("DCpasswordExpiration");
var values = new HashSet();
if (result.total == 1) {
    if (result.results[0].password_expiration_date != null) {
        d = new Date(result.results[0].password_expiration_date * 1000);
        val = new StringAttributeValue(d.toISOString()); // "2018-10-25T13:00:06.000Z"
        values.add(val);
    }
}
attr.setValues(values);
connectorResults.add(attr);

-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4090 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190212/a17b829b/attachment.p7s>