<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Greetings All -</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt;">Since upgrading to IDP 4.0.1, I've noticed that on startup, some (but not all) of our activation conditions are leading to WARN entries in our logs during
IDP startup:</span><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
net.shibboleth.idp.profile.logic.AbstractAttributePredicate:105 No AttributeContext located for evaluation<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
I'm seeing one WARN entry for each activationConditionRef associated with an affected AttributeDefinition in attribute-resolver.xml, but oddly, given structurally identical attribute definitions (same type, data connector, source attribute, and encoders) only
certain definitions seem to be causing issues.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
One of our predicates is defined as follows in global.xml:</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<bean id="IsServiceAccount" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate" p:useUnfilteredAttributes="true">
<div> <property name="attributeValueMap"></div>
<div> <map></div>
<div> <entry key="isServiceAccount"></div>
<div> <list></div>
<div> <value>true</value></div>
<div> </list></div>
<div> </entry></div>
<div> </map></div>
<div> </property></div>
</bean><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
The following attribute definition (technically, its associated encoders) makes use of the predicate as an activation condition. This one doesn't seem to be associated with the log entries:</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<AttributeDefinition xsi:type="Simple" id="ad_displayName_givenName" >
<div> <InputDataConnector ref="myADLDAP" attributeNames="displayname"/></div>
<div> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName"</div>
<div> activationConditionRef="IsServiceAccount"/></div>
<div> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName"</div>
<div> activationConditionRef="IsServiceAccount"/></div>
</AttributeDefinition><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<div style="margin:0px;font-size:11pt">By contrast, this attribute definition is associated with the log entries. When I remove the activation condition references (and leave the ones associated with the above definition in place) the warnings disappear:<br class="Apple-interchange-newline">
<AttributeDefinition xsi:type="Simple" id="ad_mail">
<div style="margin:0px"> <InputDataConnector ref="myADLDAP" attributeNames="mail"/></div>
<div style="margin:0px"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail"</div>
<div style="margin:0px"> activationConditionRef="IsServiceAccount"/></div>
<div style="margin:0px"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"</div>
<div style="margin:0px"> activationConditionRef="IsServiceAccount"/></div>
</AttributeDefinition><br>
</div>
<div style="margin:0px;font-size:11pt"><br>
</div>
<div style="margin:0px;font-size:11pt">I've read through the docs and poked around the relevant IDP source but am currently at a loss trying to explain why this would happen. Is there something I'm missing here?</div>
<div style="margin:0px;font-size:11pt"><br>
</div>
<div style="margin:0px;font-size:11pt">Em Domingues</div>
<div style="margin:0px;font-size:11pt">Senior Application Developer, Identity and Access Management</div>
<div style="margin:0px;font-size:11pt">University of Iowa</div>
<div style="margin:0px;font-size:11pt"><br style="font-size:14.6667px;background-color:rgb(255, 255, 255)">
</div>
<br>
</div>
</body>
</html>