<div dir="ltr">Ian:<div><br></div><div>Thank you very much!  The mapped attribute you provided worked perfectly and did exactly what I needed (I didn't try your script suggestion).</div><div><br></div><div>Any suggestions on why/when you would choose a mapped attribute over a scripted attribute?</div><div><br></div><div>Thanks again,</div><div>Mike</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 8, 2016 at 4:43 PM, Ian Bobbitt <span dir="ltr"><<a href="mailto:ibobbitt@globalnoc.iu.edu" target="_blank">ibobbitt@globalnoc.iu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Mike,<br>
<br>
I believe bucknellEduPersonPrimaryAffili<wbr>ation.getValues() should be<br>
bucknellEduPersonPrimaryAffili<wbr>ation.getValues().get(0) but you would also probably be better served by a Mapped<br>
attribute instead. <a href="https://wiki.shibboleth.net/confluence/display/IDP30/MappedAttributeDefinition" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>MappedAttributeDefinition</a><br>
<br>
<resolver:AttributeDefinition id="<wbr>eduPersonPrimaryAffiliation" xsi:type="ad:Mapped"<br>
sourceAttributeID="<wbr>bucknellEduPersonPrimaryAffili<wbr>ation"><br>
<span class="">    <resolver:Dependency ref="myLDAP" /><br>
</span><span class="">    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.5"<br>
</span>friendlyName="<wbr>eduPersonPrimaryAffiliation" encodeType="false" /><br>
    <ad:DefaultValue>member</ad:<wbr>DefaultValue><br>
    <ad:ValueMap><br>
        <ad:ReturnValue>faculty</ad:<wbr>ReturnValue><br>
        <ad:SourceValue partialMatch="true">faculty</<wbr>ad:SourceValue><br>
    </ad:ValueMap><br>
    <ad:ValueMap><br>
        <ad:ReturnValue>staff</ad:<wbr>ReturnValue><br>
        <ad:SourceValue partialMatch="true">staff</ad:<wbr>SourceValue><br>
    </ad:ValueMap><br>
    <ad:ValueMap><br>
        <ad:ReturnValue>student</ad:<wbr>ReturnValue><br>
        <ad:SourceValue partialMatch="true">student</<wbr>ad:SourceValue><br>
    </ad:ValueMap><br>
<br>
    <ad:ValueMap><br>
        <ad:ReturnValue>alum</ad:<wbr>ReturnValue><br>
        <ad:SourceValue partialMatch="true">alum</ad:<wbr>SourceValue><br>
    </ad:ValueMap><br>
 </resolver:<wbr>AttributeDefinition><br>
<span class="HOEnZb"><font color="#888888"><br>
Ian<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
On 11/8/16 3:18 PM, Michael Dahlberg wrote:<br>
> I'm trying to populate an attribute, eduPersonPrimaryAffiliation, from another attribute that I have available in our<br>
> LDAP structure, bucknellEduPersonPrimaryAffili<wbr>ation.  Normally, I'd just release bucknellEduPersonPrimaryAffili<wbr>ation and<br>
> be done with it.  Unfortunately, the SP requires a valid value in the attribute and there are a number of entries in our<br>
> LDAP structure for this attribute that have no value (or a "not real valid" value).  Based on this I tried writing the<br>
> following resolver script:<br>
><br>
>     <resolver:AttributeDefinition id="<wbr>eduPersonPrimaryAffiliation"<br>
>                                   xsi:type="ad:Script"><br>
>         <resolver:Dependency ref="myLDAP" /><br>
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"<br>
> name="urn:mace:dir:attribute-<wbr>def:<wbr>eduPersonPrimaryAffiliation" /><br>
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.5"<br>
> friendlyName="<wbr>eduPersonPrimaryAffiliation" /><br>
><br>
>    <ad:Script><![CDATA[<br>
>         // If the user has group membership<br>
>         if (typeof eduPersonAffiliation != "undefined" ){<br>
>             value = bucknellEduPersonPrimaryAffili<wbr>ation.getValues();<br>
><br>
>             if (value.contains("faculty")){<br>
>                 strPrimary = "faculty";<br>
>             } else if (value.contains("staff")){<br>
>                 strPrimary = "staff";<br>
>             } else if (value.contains("student")){<br>
>                 strPrimary = "student";<br>
>             } else if (value.contains("alum")){<br>
>                 strPrimary = "alum";<br>
>             } else {<br>
>                 strPrimary = "member";<br>
>             }<br>
>         }<br>
>         eduPersonPrimaryAffiliation.<wbr>add(strPrimary);<br>
>         ]]></ad:Script><br>
><br>
>     </resolver:<wbr>AttributeDefinition><br>
><br>
><br>
> The IdP starts fine, but when I try and release the attribute eduPersonPrimaryAffiliation, the script tries adding a<br>
> number of attributes (uid, telephoneNumber, mail, etc) to eduPersonPrimaryAffiliation (as a "dependent attribute", which<br>
> they are clearly not) as well as the attribute retrieved from bucknellEduPersonPrimaryAffili<wbr>ation and ultimately errors<br>
> out with the error:<br>
><br>
> 14:57:45.050 - ERROR [net.shibboleth.idp.profile.<wbr>impl.ResolveAttributes:257] - [134.82.79.6] - Profile Action<br>
> ResolveAttributes: Error resolving attributes<br>
> net.shibboleth.idp.attribute.<wbr>resolver.ResolutionException: Attribute Definition 'eduPersonPrimaryAffiliation': unable to<br>
> execute script<br>
><br>
> Any suggestions will be greatly appreciated.<br>
><br>
> Thanks,<br>
> Mike<br>
><br>
><br>
<br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>