Reference Error for attribute coming with empty value from LDAP Data connector

[S, Kalidasan]

Hi Team,

We are using LDAP data connector to get values for few of the attributes from Okta LDAP and transforming them with scripts inside attribute-resolver.xml.

Issue statement:
If the attribute coming from LDAP Dataconnector is having data populated, our custom script is not throwing any reference error but during times the attribute is flowing with empty value from data connector, we are getting "ReferenceError: "departmentnumber" is not defined in nashorn:mozilla_compat.js at line number 69" when our script try to get values using .getValues() method and Shibboleth is unable to determine the identity and login fails.

Note: the incoming Data connector values are string

We tried few changes in the custom script to handle this error but ended up with Typerror.

Below is the Attribute definition for sample attribute (defined under "attribute-resolver.xml") failing with Reference error.

    <AttributeDefinition id="departmentNumber"
        xsi:type="ScriptedAttribute"
        >
        <InputDataConnector ref="oktaLDAP" attributeNames="departmentnumber" />
        <DisplayName>Department Number</DisplayName>
        <DisplayDescription>Department number.</DisplayDescription>
        <AttributeEncoder xsi:type="SAML1String"
            name="urn:mace:dir:attribute-def:departmentNumber" />
        <AttributeEncoder xsi:type="SAML2String"
            name="urn:oid:2.16.840.1.113730.3.1.2" friendlyName="departmentNumber" />
        <ScriptFile>%{idp.home}/conf/scripts/departmentNumber.js</ScriptFile>
    </AttributeDefinition>


Error snippet for reference:

2025-01-10 01:06:00,412 - DEBUG - 10.67.11.13 - [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedIdPAttributeImpl:110] - Attribute Definition 'departmentNumber': scripted attribute 'departmentNumber': values are : []
2025-01-10 01:06:00,415 - ERROR - 10.67.11.13 - [net.shibboleth.idp.profile.impl.ResolveAttributes:317] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'departmentNumber':Script did not run successfully
        at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition$AttributeDefinitionScriptEvaluator.execute(ScriptedAttributeDefinition.java:228)
Caused by: java.lang.RuntimeException: javax.script.ScriptException: ReferenceError: "departmentnumber" is not defined in nashorn:mozilla_compat.js at line number 69
        at net.shibboleth.utilities.java.support.scripting.AbstractScriptEvaluator.evaluate(AbstractScriptEvaluator.java:193)
Caused by: javax.script.ScriptException: ReferenceError: "departmentnumber" is not defined in nashorn:mozilla_compat.js at line number 69
        at jdk.scripting.nashorn/jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:477)
Caused by: jdk.nashorn.internal.runtime.ECMAException: ReferenceError: "departmentnumber" is not defined
        at jdk.scripting.nashorn/jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)

Kindly let us know if this is a known limitation or can be handled under resolver file or script. If yes, please share the documentation or KB article link.

Thanks and Regards
Kalidasan S
Advisory - Senior Solution Advisor
Cyber IAM(Okta) | Deloitte US India Risk and Financial Advisory
kalids at deloitte.com<mailto:kalids at deloitte.com> | www.deloitte.com<http://www.deloitte.com/>


This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

Deloitte refers to a Deloitte member firm, one of its related entities, or Deloitte Touche Tohmatsu Limited ("DTTL"). Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

v.E.1
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250110/8be3178c/attachment.htm>