Ex: Re: OIDC secrets in ldap and resolutionPhases

Thu Nov 16 21:15:29 UTC 2023

> From: Cantor, Scott
> Sent: Thursday, November 16, 2023 7:23 AM
> 
> It turns out BTW this is in part a bug, fixed in 5, but I don't know if it's a bug in
> the "it doesn't work" sense or just the "you see that warning" sense.

Looks like it's just a spurious warning; I checked in debug mode, and the connector generates values for the configured resolution phase:

2023-11-16 12:53:37,107 - / - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:251] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution with label: ResolverServiceClientSecretValueResolver

2023-11-16 12:53:37,149 - / - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:225] - Data Connector 'LDAP-OIDC': produced the following 2 attributes during resolution [entryDN, userPassword]

But I don't see any output from it for the other resolution phases where it should not be running:

2023-11-16 13:08:09,379 - 10.104.223.133/node04lwei62afmz31a7b65keycq1t400 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:251] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution with label: oidc/authorize

2023-11-16 13:08:22,931 - 54.235.11.37/node0dxjv6oa8g9hx1ih29xg0qcof1415 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:251] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution with label: oidc/token

> Either way, it was fixed and I'll quickly backport the fix in case there's ever a
> 4.x patch.

Cool, thanks much for the follow-up.