<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 5/11/2016 4:36 PM, Christopher Bongaarts wrote:<br>
<blockquote cite="mid:cba8c851-dbd9-25e1-0a14-4ba88a19a896@umn.edu"
type="cite">BTW, I tried the change above (Dependency on umnLDAP)
and it worked. It just makes the IdP do extra work in copying all
those attributes.</blockquote>
<br>
So "worked" may have been too strong a word. It does indeed work
for users who have umnCareerOffice populated in LDAP. But if you
don't have the attribute populated, the attribute resolver throws an
exception.<br>
<br>
2016-05-11 16:07:02,635 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute
definition 'umnCampusMail' produced an attribute with 0 values<br>
2016-05-11 16:07:02,635 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:372]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving
dependencies for 'umnCareerOffice'<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:372]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving
dependencies for 'umnCareerOfficeExpanded'<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:372]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving
dependencies for 'umnCareerOfficeSplit'<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:388]
- Attribute Resolver 'ShibbolethAttributeResolver': Finished
resolving dependencies for 'umnCareerOfficeSplit'<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:210]
- Attribute Definition 'umnCareerOfficeSplit': adding
to-be-populated attribute to script context<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:216]
- Attribute Definition 'umnCareerOfficeSplit': adding contexts to
script context<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:226]
- Attribute Definition 'umnCareerOfficeSplit': adding emulated V2
request context to script context<br>
2016-05-11 16:07:02,636 - DEBUG
[net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:231]
- Attribute Definition 'umnCareerOfficeSplit': adding dependent
attribute 'umnOTRSuppress' with the following values to the script
context: [StringAttributeValue{value=TRUE}]<br>
[....etc...]<br>
2016-05-11 16:07:02,641 - DEBUG
[net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition:231]
- Attribute Definition 'umnCareerOfficeSplit': adding dependent
attribute 'umnModemAccess' with the following values to the script
context: [StringAttributeValue{value=FALSE}]<br>
2016-05-11 16:07:02,651 - ERROR
[net.shibboleth.idp.profile.impl.ResolveAttributes:257] - Profile
Action ResolveAttributes: Error resolving attributes<br>
net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute
Definition 'umnCareerOfficeSplit': unable to execute script<br>
at
net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition.doAttributeDefinitionResolve(ScriptedAttributeDefinition.java:169)<br>
Caused by: javax.script.ScriptException: ReferenceError:
"umnCareerOffice" is not defined in nashorn:mozilla_compat.js at
line number 67<br>
at
jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:467)<br>
Caused by: jdk.nashorn.internal.runtime.ECMAException:
ReferenceError: "umnCareerOffice" is not defined<br>
at
jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)<br>
<br>
This is with the configuration where umnCareerOfficeSplit has a
Dependency on umnLDAP (the data connector), with a sourceAttributeID
of umnCareerOffice. Yes, the first line of the Script is:
load("nashorn:mozilla_compat.js");<br>
<br>
I'll try it again without specifying the sourceAttributeID (since
for Script, it's pulling in all the LDAP attributes anyway...)<br>
<br>
I'd bet that converting the script to use the V3 conventions would
also mitigate (or at least change) this behavior.<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>