Hi all,<div><br></div><div>I think I have the AttributeDefinition setup correctly, but for some reason Shib is telling me i am producing a null attribute. The goal is to release only a specific set of prefixed</div><div>group names to a certain relying party. We first take all of the values in the memberOf attribute from AD via the LDAP connector, check for the leading prefix match and then strip</div>
<div>out the CN value from the DN string; after that, we join it all together into a comma separated list for the attribute value. When I run aacli.sh for this (or any SP), it produces no output and instead I get this in the logs (note: i'm logging inside the attribute definition to debug the issue). At the bottom, i've posted the Attribute definition.</div>
<div><br></div><div>Any insights would be much appreciated.</div><div><br></div><div>thx</div><div><br></div><div>--- log ---</div><div><div><div>08:58:20.343 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:180] - shibboleth.HandlerManager service loaded new configuration</div>
<div>08:58:20.344 - WARN [edu.internet2.middleware.shibboleth.common.config.service.ServletContextAttributeExporter:74] - This service may only be used when services are loaded within a web application context.</div><div>
08:58:20.453 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Retrieved memberOf. size = 16</div><div>08:58:20.454 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=blogadmins,OU=Security Groups,OU=NYC,DC=thegalil</div>
<div>eoschool,DC=org</div><div>08:58:20.455 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=IT NA,OU=Distribution Groups,OU=NYC,DC=thegalile</div><div>oschool,DC=org</div><div>08:58:20.455 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=GGG - IT New York,OU=Distribution Groups,OU=NYC,DC=thegalileoschool,DC=org</div>
<div>08:58:20.456 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=NA-NYC1-Xinet Notifications,OU=Distribution Groups,OU=NYC,DC=thegalileoschool,DC=org</div><div>08:58:20.457 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group matched:NA-NYC1-Xinet Notifications</div>
<div>08:58:20.457 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=Web Services,OU=Hidden Service DL,OU=Distributio</div><div>n Groups,OU=NYC,DC=thegalileoschool,DC=org</div><div>08:58:20.458 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=NetBackupAdmins,OU=Security Groups,OU=NYC,DC=the</div>
<div>galileoschool,DC=org</div><div>08:58:20.458 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=VPN-GGG,OU=Security Groups,OU=NYC,DC=thegalileos</div><div>chool,DC=org</div><div>08:58:20.458 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=Taleo Perform – managers,OU=Distribution Groups,</div>
<div>OU=NYC,DC=thegalileoschool,DC=org</div><div>08:58:20.460 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=zzzDearDavid-PleaseDisablePublicGroups,CN=Users,DC=thegalileoschool,DC=org</div>
<div>08:58:20.461 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=NA-NYC1-Dev-SG,OU=Security Groups,OU=NYC,DC=thegalileoschool,DC=org</div><div>08:58:20.461 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group matched:NA-NYC1-Dev-SG</div>
<div>08:58:20.462 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=IT Global Leadership,OU=Distribution Groups,OU=N</div><div>YC,DC=thegalileoschool,DC=org</div><div>08:58:20.462 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=dev,OU=Security Groups,OU=NYC,DC=thegalileoschool,DC=org</div>
<div>08:58:20.463 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-2] - Group:CN=DavidLiuLovesPublicGroupsAndKittens,CN=Users,DC=thegalileoschool,DC=org</div><div>08:58:20.463 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Group:CN=ThisIsAGroupWhereICanMakeUpAName,CN=Users,DC=thegalileoschool,DC=org</div>
<div>08:58:20.464 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Group:CN=Group,OU=Distribution Groups,OU=NYC,DC=thegalileoschool,DC=org</div><div>08:58:20.465 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Group:CN=NA-NYC1-Digitalteam_PVadmin,OU=Security Groups,OU=NYC,DC=thegalileoschool,DC=org</div>
<div>08:58:20.466 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Group matched:NA-NYC1-Digitalteam_PVadmin</div><div>08:58:20.466 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.foo:-1] - Sending back zonzagroups:NA-NYC1-Xinet Notifications,NA-N</div>
<div>YC1-Dev-SG,NA-NYC1-Digitalteam_PVadmin</div><div>08:58:20.467 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition</div><div>:129] - zonza-groups produced a null attribute</div>
<div>08:58:20.471 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.AttributeAuthorityCLI:392] - Error encountered during attribute r</div><div>esolution and filteringedu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException: zonza-groups produced a null attributes</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition.doResolve(ScriptedAttributeDefinition.java:130) ~[shibboleth-common-1.3.5.jar:na]</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:108) ~[shibboleth-common-1.3.5.jar:na]</div><div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:39) ~[shibboleth-common-1.3.5.jar:na]</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ContextualAttributeDefinition.resolve(ContextualAttributeDefinition.java:93) ~[shibboleth-common-1.3.5.jar:na]</div>
</div></div><div><div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ContextualAttributeDefinition.resolve(ContextualAttributeDefinition.java:33) ~[shibboleth-common-1.3.5.jar:na]</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttribute(ShibbolethAttributeResolver.java:335) ~[shibboleth-common-1.3.5.jar:na]</div><div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:284) ~[shibboleth-common-1.3.5.jar:na]</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:131) ~[shibboleth-common-1.3.5.jar:na]</div><div> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:174) ~[shibboleth-common-1.3.5.jar:na]</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:58) ~[shibboleth-common-1.3.5.jar:na]</div><div> at edu.internet2.middleware.shibboleth.common.attribute.AttributeAuthorityCLI.performSAML2AttributeResolution(AttributeAuthorityCLI.java:261) [shibboleth-common-1.3.5.jar:na]</div>
<div> at edu.internet2.middleware.shibboleth.common.attribute.AttributeAuthorityCLI.main(AttributeAuthorityCLI.java:103) [shibboleth-common-1.3.5.jar:na]</div></div><div><br></div><div>--- log ---</div><div><br></div>
<div>--- attribute-resolver.xml ---</div><div><div> <resolver:AttributeDefinition id="zonza-groups" xsi:type="Script"</div><div> xmlns="urn:mace:shibboleth:2.0:resolver:ad"</div>
<div> sourceAttributeID="memberOf"></div><div> <resolver:Dependency ref="myLDAP" /></div><div><br></div><div> <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="<a href="http://thegalileoschool.org/identity/zonza/zonza-groups">http://thegalileoschool.org/identity/zonza/zonza-groups</a>" /></div>
<div> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="<a href="http://thegalileoschool.org/identity/zonza/zonza-groups">http://thegalileoschool.org/identity/zonza/zonza-groups</a>" friendlyName="zonza-groups" /></div>
<div><br></div><div> <Script></div><div> <![CDATA[</div><div> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);</div><div> importPackage(Packages.org.slf4j);</div>
<div><br></div><div> logger = LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.foo");</div><div><br></div><div> zonzagroups = new BasicAttribute("zonza-groups");</div>
<div> var ngroup = memberOf.getValues().size();</div><div> var grouplist = [];</div><div> var grpstr = "none";</div><div><br></div><div> <a href="http://logger.info">logger.info</a>("Retrieved memberOf. size = " + ngroup); </div>
<div><br></div><div> for(var i=0; memberOf != null && i < ngroup; i++) {</div><div><br></div><div> var group = memberOf.getValues().get(i);</div><div><br></div><div> <a href="http://logger.info">logger.info</a>("Group:" + group);</div>
<div><br></div><div> if(group.toLowerCase().indexOf("cn=na-") == 0) {</div><div> var re = /^cn=(.+?)\,/i;</div><div> var match = re.exec(group);</div>
<div> var grpname = match[1];</div><div> grouplist.push(grpname);</div><div> <a href="http://logger.info">logger.info</a>("Group matched:" + grpname);</div>
<div> }</div><div> </div><div> }</div><div><br></div><div> if( grouplist.length > 0 ) {</div><div> grpstr = grouplist.join(","); </div>
<div> }</div><div> <a href="http://logger.info">logger.info</a>("Sending back zonzagroups:" + grpstr);</div><div> zonzagroups.getValues().add(grpstr);</div><div> ]]></div>
<div> </Script></div><div><br></div><div> </resolver:AttributeDefinition></div></div><div>--- attribute-resolver.xml ---</div>