Ex: Re: OIDC secrets in ldap and resolutionPhases

[Paul B. Henson]

On Sat, Nov 11, 2023 at 04:14:26PM +0000, Cantor, Scott via users wrote:
> Warnings don't mean it's not working.

Well, I generally interpret a warning as a sign either something is
broken or something might be broken 8-/. And "hey, I interpreted that
string as false, hope that's ok with you" isn't something, at least to
me, that can be intuitively ignored :).

> The Spring warning isn't fixable, there's a bug In their conversion
> code

Ah, so there is something broken, just not in the idp itself.

> but it doesn't inherently mean it's not parsing it correctly, it
> just means it tried for a boolean conversion first before that failed.

How would it know the boolean conversion failed? Looking at the code:

https://shibboleth.net/sites/release/spring-extensions/6.0.0/xref/net/shibboleth/ext/spring/config/StringBooleanToPredicateConverter.html

other than logging the warning, there's no way for a caller to tell if
false was returned because the string was "false", or if false was
returned because there was some other random thing it decided to assume
was false?

> The code that parses the two settings is exactly the same apart from
> wrapping the exclude case in a NOT.

Maybe the include case should be NOT(NOT(xxx)) then ;).

I guess the consensus is to just ignore it, thanks for the info.

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768