<div dir="ltr">I've got a scripted attribute definition to look up nested group membership against our eDirectory backend.  I have to do the lookup against the group object, which makes the lookup more expensive than I'd like, and we don't want to run it for every service provider.<div><br></div><div>I'd like to control this attribute using a tag in the metadata, so added this to the SP's metadata..</div><div>      <mdattr:EntityAttributes><br></div><div>        <saml:Attribute Name="<a href="https://its.umich.edu/identity/activationCondition/isMemberOf">https://its.umich.edu/identity/activationCondition/isMemberOf</a>" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>          <saml:AttributeValue xsi:type="xsd:boolean">true</saml:AttributeValue><br>        </saml:Attribute><br>      </mdattr:EntityAttributes><br></div><div><br></div><div>I then defined an activation condition based on the "RelyingPartyByTag" example at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-RelyingPartiesByTag">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-RelyingPartiesByTag</a></div><div><br></div><div>    <bean id="isMemberOf_Condition" parent="shibboleth.Conditions.EntityDescriptor"><br>        <constructor-arg name="pred"><br>            <bean class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate"><br>                <constructor-arg><br>                    <list><br>                        <bean class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"<br>                            c:name="<a href="https://its.umich.edu/identity/activationCondition/isMemberOf">https://its.umich.edu/identity/activationCondition/isMemberOf</a>"<br>                            p:values="true" /><br>                    </list><br>                </constructor-arg><br>             </bean><br>       </constructor-arg><br>    </bean><br></div><div><br></div><div>...and attached it to my attribute definition...</div><div>    <AttributeDefinition id="isMemberOfScripted" xsi:type="ScriptedAttribute" language="nashorn" activationConditionRef="isMemberOf_Condition"><br>        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf"/><br>        <AttributeEncoder xsi:type="oidcext:OIDCString" asArray="true" name="edumember_ismemberof" /><br>        <ScriptFile>/usr/local/mcomm/shibboleth-idp/script/isMemberOfScripted.js</ScriptFile><br>    </AttributeDefinition><br></div><div><br></div><div>The IDP loads, but the activation condition is not triggering..</div><div><br></div><div>2019-07-17 16:36:53,409 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:183] - x.x.x.x - Resolver plugin 'isMemberOfScripted': activation criteria not met, nothing to do<br>2019-07-17 16:36:53,410 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:337] - x.x.x.x - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'isMemberOfScripted' produced no attribute<br></div><div><br></div><div>The attributes with functional activation conditions are of type shibboleth.Conditions.RelyingPartyId, but this one is shibboleth.Conditions.EntityDescriptor.  I'm guessing there's additional stuff that I need to add.</div><div><br></div><div>Any pointers?</div><div>Liam</div></div>