<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 14px;" lang="x-western">Hello all,
<br>
<br>
I sent this out a couple of weeks ago but didn't get any responses
so I figured I'd send it again in case it was missed. Any
suggestions or assistance would be greatly appreciated.<br>
<br>
We are using LDAP user/pass authentication with Shibboleth IdP
2.3.5. We currently extract the password as an attribute for one
specific internal SP using this code:
<br>
<br>
<!-- Add password as attribute-->
<br>
<resolver:AttributeDefinition id="password" xsi:type="Script"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">
<br>
<resolver:AttributeEncoder xsi:type="SAML1String"
<br>
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
<br>
name="urn:mace:dir:attribute-def:password" />
<br>
<br>
<resolver:AttributeEncoder xsi:type="SAML2String"
<br>
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
<br>
name="urn:oid:2.5.4.35"
<br>
friendlyName="password" />
<br>
<Script>
<br>
<![CDATA[
<br>
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);<br>
importPackage(Packages.edu.internet2.middleware.shibboleth.idp.authn.provider);<br>
importPackage(Packages.java.io.*);
<br>
<br>
// Create new password attribute
<br>
password = new BasicAttribute("password");
<br>
// Get subject only if the session exists (to avoid smal1)
<br>
if( requestContext.getUserSession() )
<br>
{
<br>
// Get Subject
<br>
userSubject =
requestContext.getUserSession().getSubject();
<br>
// There are two PrivateSessions existed, only get class
UsernamePasswordCredential
<br>
i =
userSubject.getPrivateCredentials(edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordCredential).iterator();<br>
while(i.hasNext()) {
<br>
credential = i.next();
<br>
password.getValues().add(credential.getPassword());
<br>
}
<br>
}
<br>
]]>
<br>
</Script>
<br>
</resolver:AttributeDefinition>
<br>
<br>
This has worked fine for us over the past few years. Lately,
however, whenever we restart the IdP we sometimes get the
following error in idp-process.log:
<br>
<br>
WARN
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition:153]
- password unable to compile even though the scripting engine
supports this functionality.
<br>
<br>
This error happened in our old 2.1.5 IdP as well as the new 2.3.5
instance. It seems that the error shows up completely at random.
Sometimes after a restart we don't get it at all, other times it
will appear once and then not come back after another reboot, and
other times we will have to keep restarting the IdP several times
for it to not appear. When it does appear, though, SPs will be
able to create valid sessions with the IdP, but no attributes will
be released to any SP.
<br>
<br>
Does anyone have an explanation as to why this error shows up at
random or what is causing it?
<br>
<br>
Thanks,
<br>
Mike
<br>
Stevens Institute of Technology<br>
</div>
</body>
</html>