<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 8/1/2016 6:04 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:cb36eece-1d41-c5a0-5266-72e97889934c@osu.edu"
type="cite">
<blockquote type="cite" style="color: #000000;">
<pre wrap="">Both of these sound to me like I should be using some sort of temporary
<span class="moz-txt-citetags">> </span>attribute context within the intercept, but I'm not quite sure where it
<span class="moz-txt-citetags">> </span>should go in the Giant Context Tree, or how to specify it (perhaps
<span class="moz-txt-citetags">> </span>defining more shibboleth.ChildLookup(orCreate) beans).
</pre>
</blockquote>
<pre wrap="">p:setAttributeContextCreationStrategy-ref=
"shibboleth.ChildLookupOrCreate.AttributeContext"
I don't know where you could really put it that's appropriate, but
ironically putting it directly under the root is not actually going to
conflict, the official attributes are left under the
RelyingPartyContext. Which the above should do.
</pre>
</blockquote>
<br>
When I try using this, it will correctly find the password status,
but on subsequent iterations of the loop, it doesn't pick up the
changes. I can see the resolver find the new value:<br>
<br>
2016-08-03 12:55:10,013 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247]
- Attribute Definition 'umnPasswordStatus': produced an attribute
with the following values [StringAttributeValue{value=Q}]<br>
2016-08-03 12:55:10,014 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute
definition 'umnPasswordStatus' produced an attribute with 1 values<br>
2016-08-03 12:55:10,014 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:201]
- Attribute Resolver 'ShibbolethAttributeResolver': Finalizing
resolved attributes<br>
2016-08-03 12:55:10,014 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:434]
- Attribute Resolver 'ShibbolethAttributeResolver': De-duping
attribute definition umnPasswordStatus result<br>
2016-08-03 12:55:10,014 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:446]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute
'umnPasswordStatus' has 1 values after post-processing<br>
<br>
<p>but it either doesn't get saved in the context, or the existing
value is not removed:</p>
<p>2016-08-03 12:55:10,015 - DEBUG
[edu.umn.oit.idm.shib.RegexAttributePredicate:76] - Checking for
attribute: umnPasswordStatus<br>
2016-08-03 12:55:10,015 - DEBUG
[edu.umn.oit.idm.shib.RegexAttributePredicate:87] - Found matching
value (XI) in attribute umnPasswordStatus<br>
<br>
</p>
<p>Is there a way to easily delete an existing subcontext from the
flow? something like</p>
<p><evaluate
expression="opensamlProfileRequestContext.removeContext(AttributeResolutionContext.class"></p>
<p>(will try that now....)<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>