IDP3 Occasionally failing to generate user attributes

[Cantor, Scott]

a) Your authentication implementation is broken and is returning some kind of string value of "(null)" or some such instead of signaling failure. You can't possibly have that kind of log output without it doing something very, very wrong in the External bridge code.

The code absolutely checks for null there, which means the value isn't in fact null, it's actually got to be that string. That should never happen.

b) Your attribute logic is reacting to errors (or suppressing them) in such a way as to allow the absence of any information to be successful and not raise fatal errors, and having done that, you are deciding that issuing empty assertions is an acceptable outcome.

There are error handling options all over the system to influence all of that.

(a) is honestly of much greater concern. There's no way that should be happening and that isn't the IdP doing that, it's the other side of that callout.

-- Scott