<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:11pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
Hi Martin,
<div><br>
</div>
<div>Thanks for that. I had a solution like that drafted yesterday, but eventually decided to just resolve it upstream by altering the SQL view definition to sub in the appropriate value before it even gets to the IdP.</div>
<div><br>
</div>
<div>Michael</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Martin Lunze <martin.lunze@tu-dresden.de><br>
<b>Sent:</b> Friday, August 11, 2017 12:15:52 AM<br>
<b>To:</b> Domingues, Michael D<br>
<b>Cc:</b> Shib Users<br>
<b>Subject:</b> Re: Activation Condition Predicate for an Empty Attribute</font>
<div> </div>
</div>
<div>
<p>Hi Michael,</p>
<p><br>
</p>
<p>maybe it's a possible alternative to solve this problem with a scripted attribute-definition like that?</p>
<p><br>
</p>
<p></p>
<blockquote type="cite"> <Script><br>
<![CDATA[<br>
if (typeof your-other-attr !== "undefined" && your-other-attr.getValues().size() > 0) {<br>
mail.addValue(your-other-attr.getValues().get(0));<br>
} else {<br>
mail.addValue("some-special-value");<br>
}<br>
]]><br>
</Script><br>
</blockquote>
<p></p>
<p><br>
</p>
<p>With nice regards</p>
<p>Martin<br>
</p>
<br>
<div class="moz-cite-prefix">On 10.08.2017 18:01, Domingues, Michael D wrote:<br>
</div>
<blockquote type="cite" cite="mid:DM5PR04MB08927B593717CBC64813F002EA880@DM5PR04MB0892.namprd04.prod.outlook.com">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size: 11pt; color:
rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif,
EmojiFont, "Apple Color Emoji", "Segoe UI
Emoji", NotoColorEmoji, "Segoe UI Symbol",
"Android Emoji", EmojiSymbols;" dir="ltr">
<p>Hi All,</p>
<p><br>
</p>
<p>I'm currently attempting to write an Activation Condition predicate to test if an attribute is empty. The approach that I've taken, modeled off the documentation [1] is to wrap a wildcard SimpleAttributePredicate in a NOT condition like so:<br>
</p>
<div><br>
</div>
<div><!-- Ensure that mail is not already populated --><br>
<bean parent="shibboleth.Conditions.NOT"><br>
<constructor-arg><br>
<bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry key="mail"><br>
<list><br>
<value>*</value><br>
</list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</constructor-arg><br>
</bean></div>
<br>
Unfortunately, in so doing, I discovered that SimpleAttributePredicate wildcarding returns true, even for empty attributes (that get pulled out of the connected data source as EmptyAttributeValue objects). This seems like a bug to me, and I've filed a report
here [2].
<p><br>
</p>
<p>As a stop-gap, does anybody have a good approach (outside of writing a custom predicate bean myself) to return true only if an attribute is empty or non-existent?</p>
<p><br>
</p>
<p>Many thanks in advance,</p>
<p>Michael<br>
<br>
[1] <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions" class="OWAAutoLink" id="LPlnk638571" previewremoved="true" moz-do-not-send="true">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions</a></p>
<p>[2] <a href="https://issues.shibboleth.net/jira/browse/IDP-1206" class="OWAAutoLink" id="LPlnk442295" previewremoved="true" moz-do-not-send="true">https://issues.shibboleth.net/jira/browse/IDP-1206</a></p>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Martin Lunze
IT-Systemadministrator
Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Prozessmanagement und Controlling (PMC)
01062 Dresden
Tel.: +49 (351) 463-35881
E-Mail: <a class="moz-txt-link-abbreviated" href="mailto:martin.lunze@tu-dresden.de">martin.lunze@tu-dresden.de</a></pre>
</div>
</body>
</html>