<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Unfortunately, switching to Oracle’s JDK (1.7.0_80) gives the same results. I pasted in the sample code and verified that there are no typos in the call to getInboundMessageTransport(). This is all on the front-channel (we don’t have any applications
that use the SAML1 back channel). </div>
<div><br>
</div>
<div>Code:</div>
<div>
<blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px;">logger.debug("Inbound transport peer address: {}", requestContext.getInboundMessageTransport().getPeerAddress());</blockquote>
<div>
<div id=""></div>
</div>
</div>
<div>
<div>Log entry:</div>
<blockquote style="margin:0 0 0 40px; border:none; padding:0px;">
<div>2015-05-27 12:49:43.800 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ScriptedAttributeDefinition:136] - 1D5EB29135FDC4F092D53E8C16B6CFDA - ScriptletAttributeDefinition validAuthContexts unable to execute
script javax.script.ScriptException: sun.org.mozilla.javascript.internal.EcmaError: TypeError: Cannot call method "getPeerAddress" of null (<Unknown Source>#117) in <Unknown Source> at line number 117</div>
</blockquote>
</div>
<div><br>
</div>
<div>We are using the Multi Context Broker to provide two-factor authentication. The MCB plugin logs the the peer IP address so I know that this is available at the point just prior to doing attribute resolution. I wonder if there is an issue with the requestContext
as it is passed from the MCB nto the attribute resolver code?</div>
<div>
<div id="">
<blockquote style="margin:0 0 0 40px; border:none; padding:0px;">
<div><br>
</div>
</blockquote>
<div>Thanks,</div>
<div>Mark</div>
<div><br>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>users on behalf of Mark McCoy<br>
<span style="font-weight:bold">Reply-To: </span>Shib Users<br>
<span style="font-weight:bold">Date: </span>Wednesday, May 27, 2015 at 12:00 PM<br>
<span style="font-weight:bold">To: </span>Shib Users<br>
<span style="font-weight:bold">Subject: </span>Re: getInboundMessageTransport always returns a null value<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>I’ll try switching to Oracle’s JDK instead of OpenJDK and let everyone know if I see a difference.</div>
<div>
<div id="">
<div><br>
</div>
<div>Thanks,</div>
<div>Mark</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>users on behalf of Brent Putman<br>
<span style="font-weight:bold">Reply-To: </span>Shib Users<br>
<span style="font-weight:bold">Date: </span>Tuesday, May 26, 2015 at 5:06 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>"<br>
<span style="font-weight:bold">Subject: </span>Re: getInboundMessageTransport always returns a null value<br>
</div>
<div><br>
</div>
<div>
<div bgcolor="#FFFFFF" text="#000000"><br>
<br>
<div class="moz-cite-prefix">On 5/26/15 11:49 AM, Mark McCoy wrote:<br>
</div>
<blockquote cite="mid:9A65B4FB-6F6B-46D9-BD62-139A2D972C81@utsa.edu" type="cite">
<div>We are trying to add a check on the user’s IP address to determine whether or not the user is coming from on or off campus.</div>
<div><br>
</div>
<br>
<div>In a scripted attribute, I’ve tried to use the following calls to get the user’s IP address.
</div>
</blockquote>
<br>
<br>
For the record, on what type of SAML request flow do you see it not working correctly: SAML 1 vs 2? Front-channel vs back-channel attribute query? Everything?<br>
<br>
<br>
<blockquote cite="mid:9A65B4FB-6F6B-46D9-BD62-139A2D972C81@utsa.edu" type="cite">
<div>Every call results in the getInboundMessageTransport() returning a null value, which obviously causes the getPeerAddress() call to fail. Other calls to methods contained within the requestContext succeed (example, the getEntityId() call works fine).</div>
</blockquote>
<br>
Well, I tested the basic SAML 2 front-channel authN request flow case, and it worked ok for me. I just did some logging of various bits:<br>
<br>
<tt>importPackage(Packages.org.slf4j);</tt><tt><br>
</tt><tt><br>
</tt><tt>logger = LoggerFactory.getLogger("BRENT.script-test");</tt><tt><br>
</tt><tt><br>
logger.debug("Inbound message issuer: {}", requestContext.getInboundMessageIssuer());</tt><tt><br>
</tt><tt>logger.debug("Peer entityID: {}", requestContext.getPeerEntityId());</tt><tt><br>
</tt><tt>logger.debug("Inbound message transport: {}", requestContext.getInboundMessageTransport());</tt><tt><br>
</tt><tt>logger.debug("Inbound transport peer address: {}", requestContext.getInboundMessageTransport().getPeerAddress());</tt><br>
<br>
<br>
<br>
The inbound transport was as expected an instance of the servlet request adapter, and the peerAddress was available:<br>
<br>
<tt>17:51:54.208 - DEBUG [BRENT.script-test:-2] - Inbound message issuer: <a class="moz-txt-link-freetext" href="https://www.test.middleware.georgetown.edu/shibboleth">
https://www.test.middleware.georgetown.edu/shibboleth</a></tt><tt><br>
</tt><tt>17:51:54.211 - DEBUG [BRENT.script-test:-2] - Peer entityID: <a class="moz-txt-link-freetext" href="https://www.test.middleware.georgetown.edu/shibboleth">
https://www.test.middleware.georgetown.edu/shibboleth</a></tt><tt><br>
</tt><tt>17:51:54.212 - DEBUG [BRENT.script-test:-2] - Inbound message transport: org.opensaml.ws.transport.http.HttpServletRequestAdapter@4eae78e5</tt><tt><br>
</tt><tt>17:51:54.212 - DEBUG [BRENT.script-test:-2] - Inbound transport peer address: 10.212.128.228</tt><tt><br>
</tt><br>
<br>
<br>
<blockquote cite="mid:9A65B4FB-6F6B-46D9-BD62-139A2D972C81@utsa.edu" type="cite">
<div><br>
</div>
<blockquote style="margin:0 0 0 40px; border:none; padding:0px;">
<div>
<div>try {</div>
<div> var ipAddress = requestContext.getInboundMessageTransport().getPeerAddress();</div>
<div>} catch (err) {</div>
<div> var ipAddress = 'unavailable'</div>
<div> logger.warn(pre + err);</div>
<div>}</div>
<div>logger.debug(pre + "ipAddress = " + ipAddress);</div>
</div>
</blockquote>
<div>
<div id="">
<div><br>
</div>
</div>
</div>
</blockquote>
<br>
Off-hand I don't spot any typos etc there, but I'd double-check what you actually have in the script.<br>
<br>
<br>
<br>
<blockquote cite="mid:9A65B4FB-6F6B-46D9-BD62-139A2D972C81@utsa.edu" type="cite">
<div>
<div id="">
<div></div>
<div><br>
</div>
<br>
<div>Any suggestions?</div>
<br>
</div>
</div>
</blockquote>
<br>
<br>
Nothing other than just checking for typos, making sure you've restarted after making all changes, etc. I don't think that the i<tt>nboundMessageTransport</tt> property on the context can ever be null. That's fundamentally how the HttpServletRequest is accessed
and processed. So I think you have something else amiss here. Maybe try copy/pasting my above logging code directly, and see what results you get.<br>
<br>
I suppose it could be some sort of weird scripting bug we haven't encountered yet. Actually, I note you said you're using OpenJDK 1.7.0.75. We have had reports of various weird bugs that went away when OpenJDK was switched out for Oracle JDK ,etc. So I guess
you might try that.<br>
<br>
--Brent<br>
<br>
<br>
</div>
</div>
</span></div>
</div>
</span>
</body>
</html>