Question about Scripted attribute in attribute-resolver.xml

[Emilie Boulard]

Hello all, 

I have an instance of Shibboleth IDP v4 freshly installed and running and i need to define an attribute with a scripted attribute type. 


For context: I need to define and send some specific attribute for my SP: firstname, lastname, mail and group for a given user. 
I managed to get almost all of them with this configuration: 



</AttributeResolver> 
[...] 
<AttributeDefinition id="Firstname" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="givenName"/> <AttributeEncoder xsi:type="SAML2String" name="firstname"/> </AttributeDefinition> 
<AttributeDefinition id="Lastname" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="sn"/> <AttributeEncoder xsi:type="SAML2String" name="lastname"/> </AttributeDefinition> 
<AttributeDefinition id="Groups" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="gidNumber"/> <AttributeEncoder xsi:type="SAML2String" name="groups"/> </AttributeDefinition> 
<AttributeDefinition id="Mail" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="mail"/> <AttributeEncoder xsi:type="SAML2String" name="mail"/> </AttributeDefinition> 

<DataConnector id="myLDAP" xsi:type="LDAPDirectory" 
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}" 
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
principal="%{idp.attribute.resolver.LDAP.bindDN}" 
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}" 
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}" 
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}" 
exportAttributes="uid mail gidNumber sn givenName"> 
<FilterTemplate> 
<![CDATA[ 
%{idp.attribute.resolver.LDAP.searchFilter} 
]]> 
</FilterTemplate> 
</DataConnector> 
</AttributeResolver> 





As you cans see,i get the gidNumber because my ldap doesn't send the gid only in an non numerical way. 
And it is not what i really need, so i thought about use a Scripted Attribute to get my group name in a more human readable thing than a gidNumber. 


My starting point was to do somethin equivalent to the unix command " id -gn uid " to get the gid in all letter for a given uid. 
I read this page [ https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631560/ScriptedAttributeDefinition | https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631560/ScriptedAttributeDefinition ] but i didn't find a way to modifiy my uid attribute with a JSR 223 script with the avalaible class in the documentation. 
So i though about using system functions. Frst i though of writing some java script and only use the function in my scripted attribute, but i didn't find if it is possible to point a path to a script in a attribute definition. 

Then, I tried this and it didn't work (i must add that i have absolutetly no knowledge about java language so this is IA generated, sorry about that): 

BQ_BEGIN

<AttributeDefinition id="group" xsi:type="ScriptedAttribute"> 
<InputDataConnector ref="MyLDAP" attributeNames="uid" /> 
<Script><![CDATA[ 
import java.io.*; 
def executeCommand(String command) { 
def process = command.execute() 
process.waitFor() 
return process.in.text.trim() 
} 
var uid = uid.get(0); 
var command = "id -gn " + uid; 
var groupName = executeCommand(command); 
if (groupName != null && !groupName.isEmpty()) { 
var attribute = new javax.naming.directory.BasicAttribute("group", groupName); 
return [attribute]; 
} else { 
return []; 
} 
]]></Script> 
</AttributeDefinition> 

BQ_END

The error log was pretty clear that i didn't use the Script part like intended: 

BQ_BEGIN

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'group': Cannot create inner bean '(inner bean)#4017cc34' of type [net.shibboleth.ext.spring.factory.EvaluableScriptFactoryBean] while setting bean property 'script'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#4017cc34': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: javax.script.ScriptException: <eval>:1:0 Expected an operand but found import 
import java.io.*; 
^ in <eval> at line number 1 at column number 0 

BQ_END

So i thought maybe i am doing this the wrong way and try to made something more complicated than needed. 

Is anyone who had the same need for an ldap attribute? Do i miss something crucial in the documentation that can permit an easy attribute definition? 

May thanks and best regards, 

Emilie 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240229/1d5bbaf5/attachment.htm>