p:postAuthenticationFlows issue

[Donald Lohr]

I have created a ../flows/intercept bean to use as a 
p:postAuthenticationFlows element in the relying-party.xml file.

The desired is to use the eduPersonScopedAffiliation attribute (defined 
in our attribute-resolver.xml file) to block users that are not students 
from certain applications.

1) A little back history first, our eduPersonScopedAffiliation is 
defined as:

     <AttributeDefinition xsi:type="Scoped" 
id="eduPersonScopedAffiliation" scope="jmu.edu">
         <InputDataConnector ref="oud" 
attributeNames="eduPersonAffiliation"/>
         <AttributeEncoder xsi:type="SAML2ScopedString" 
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" 
friendlyName="eduPersonScopedAffiliation" />
     </AttributeDefinition>

...where you can see is a Scoped type, but is sourced from our LDAP 
eduPersonAffiliation attribute.

A typical student would have the following multi-values like:

student
member

Thus this attribute-resolver definition would Scope those 
eduPersonAffiliation values to:

student at jmu.edu
member at jmu.edu

A faculty would have in LDAP:

faculty
employee
member

Thus this attribute-resolver definition would Scope those 
eduPersonAffiliation values to:

faculty at jmu.edu
employee at jmu.edu
member at jmu.edu

2) The new bean for the postAuthenticationFlows has the following:

<bean id="ContextCheckPredicate" parent="shibboleth.Conditions.NOT">
         <constructor-arg>
                 <bean 
class="net.shibboleth.idp.profile.logic.RegexAttributePredicate" 
p:useUnfilteredAttributes="true" p:pattern="XXXXX" p:attributeId="YYYYY"/>
         </constructor-arg>
</bean>

I have used the following values for the XXXXX & YYYYY value (noted 
above) with the following failure or success:

XXXXX = student             YYYYY = eduPersonAffiliation
XXXXX = student at jmu.edu     YYYYY = eduPersonScopedAffiliation

Resulted in the following errors in the idp-process.log (DEBUG):

2022-05-13 13:06:37,567 - DEBUG 
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:110] - 
Attribute 'eduPersonAffiliation' not found in context

...or

2022-05-13 13:06:37,567 - DEBUG 
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:110] - 
Attribute 'eduPersonScopedAffiliation' not found in context

But if I use an attribute that is not a multi-valued attribute, I 
achieve success:

XXXXX = Lohr       YYYYY = sn
XXXXX = Donald     YYYYY = givenName

2022-05-13 13:46:31,902 - DEBUG 
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:118] - Found 
matching value 'Lohr' in attribute 'sn'

...or

2022-05-13 13:58:37,902 - DEBUG 
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:118] - Found 
matching value 'Donald' in attribute 'givenName'


Is the "Attribute 'YYYYY' not found in context" error because my "<bean 
class" syntax is not correct when the attribute is multi-valued?

I've looked but do not see or understand what the syntax should be for a 
multi-valued attribute.


Thanks,
Don

-- 
D o n a l d   L o h r
I n f o r m a t i o n   S y s t e m s
J a m e s   M a d i s o n   U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220513/128065cd/attachment.htm>