postAuthenticationFlows issue

[Donald Lohr]

Solved. Was mocking up this postAuth flow on a second Shib IdP server we 
use for non production testing stuff.

As I mentioned in the original post, the eduPersonScopedAffiliation 
attribute was defined as:


     <AttributeDefinition xsi:type="Scoped" 
id="eduPersonScopedAffiliation" scope="jmu.edu">
         <InputDataConnector ref="oud" 
attributeNames="*eduPersonAffiliation*"/>
         <AttributeEncoder xsi:type="SAML2ScopedString" 
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" 
friendlyName="eduPersonScopedAffiliation" />
     </AttributeDefinition>

The issue was, in our LDAP directory, the *eduPersonAffiliation 
*attribute is al lower case: *edupersonaffiliation*.

Case does matter. This case issues was not on our production IdP server.

Once I found that and resolved it, my post auth bean works as I expected.

Thanks,
Don


On 5/14/22 3:48 PM, Cantor, Scott via users wrote:
> CAUTION: This email originated from outside of JMU. Do not click links or open attachments unless you recognize the sender and know the content is safe.
> ________________________________
>
> As Rod said, you're going to have issues with those Predicates  when values are scoped (4.2 adds options to them to handle that), but the messages suggest that the attributes simple aren't there. They're not multi-valued, they're absent.
>
> That's not a timing thing (they'd be there by this point), it's a "the data's not there" thing.
>
>>     I've looked but do not see or understand what the syntax should be for a multi-valued attribute.
> The predicates don't care how many values exist, they check each one. They can't check something that's not there. The predicates have an option for controlling what they do in that situation as well.
>
> The Javadocs for them cover the options, including the addition of a scope setting to check for.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, seehttps://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=SToYJDLhNCxpK7GDpoeFPtZvuJBGU0XUnqc3vysbpiU&s=SIukdBfvG4Bth_4Wd3pB77DEN4wMdoA6tFHWFzo_aAY&e=
> To unsubscribe from this list send an email tousers-unsubscribe at shibboleth.net

-- 
D o n a l d   L o h r
I n f o r m a t i o n   S y s t e m s
J a m e s   M a d i s o n   U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220517/3f1600eb/attachment.htm>