<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">I have created a
../flows/intercept bean to use as a p:postAuthenticationFlows
element in the relying-party.xml file.<br>
<br>
The desired is to use the eduPersonScopedAffiliation attribute
(defined in our attribute-resolver.xml file) to block users that
are not students from certain applications.<br>
<br>
1) A little back history first, our eduPersonScopedAffiliation is
defined as:<br>
<br>
<AttributeDefinition xsi:type="Scoped"
id="eduPersonScopedAffiliation" scope="jmu.edu"><br>
<InputDataConnector ref="oud"
attributeNames="eduPersonAffiliation"/><br>
<AttributeEncoder xsi:type="SAML2ScopedString"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
friendlyName="eduPersonScopedAffiliation" /><br>
</AttributeDefinition><br>
<br>
...where you can see is a Scoped type, but is sourced from our
LDAP eduPersonAffiliation attribute. <br>
<br>
A typical student would have the following multi-values like:<br>
<br>
student<br>
member<br>
<br>
Thus this attribute-resolver definition would Scope those
eduPersonAffiliation values to:<br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:student@jmu.edu">student@jmu.edu</a><br>
<a class="moz-txt-link-abbreviated" href="mailto:member@jmu.edu">member@jmu.edu</a><br>
<br>
A faculty would have in LDAP:<br>
<br>
faculty<br>
employee<br>
member<br>
<br>
Thus this attribute-resolver definition would Scope those
eduPersonAffiliation values to:<br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:faculty@jmu.edu">faculty@jmu.edu</a><br>
<a class="moz-txt-link-abbreviated" href="mailto:employee@jmu.edu">employee@jmu.edu</a><br>
<a class="moz-txt-link-abbreviated" href="mailto:member@jmu.edu">member@jmu.edu</a><br>
<br>
2) The new bean for the postAuthenticationFlows has the following:<br>
<br>
<bean id="ContextCheckPredicate"
parent="shibboleth.Conditions.NOT"><br>
<constructor-arg><br>
<bean
class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"
p:useUnfilteredAttributes="true" p:pattern="XXXXX"
p:attributeId="YYYYY"/><br>
</constructor-arg><br>
</bean><br>
<br>
I have used the following values for the XXXXX & YYYYY value
(noted above) with the following failure or success:<br>
<br>
<font face="monospace">XXXXX = student YYYYY =
eduPersonAffiliation<br>
XXXXX = <a class="moz-txt-link-abbreviated" href="mailto:student@jmu.edu">student@jmu.edu</a> YYYYY = eduPersonScopedAffiliation<br>
</font><br>
Resulted in the following errors in the idp-process.log (DEBUG):<br>
<br>
2022-05-13 13:06:37,567 - DEBUG
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:110] -
Attribute 'eduPersonAffiliation' not found in context<br>
<br>
...or<br>
<br>
2022-05-13 13:06:37,567 - DEBUG
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:110] -
Attribute 'eduPersonScopedAffiliation' not found in context<br>
<br>
But if I use an attribute that is not a multi-valued attribute, I
achieve success:<br>
<br>
<font face="monospace">XXXXX = Lohr YYYYY = sn<br>
XXXXX = Donald YYYYY = givenName<br>
</font><br>
2022-05-13 13:46:31,902 - DEBUG
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:118] -
Found matching value 'Lohr' in attribute 'sn'<br>
<br>
...or<br>
<br>
2022-05-13 13:58:37,902 - DEBUG
[net.shibboleth.idp.profile.logic.RegexAttributePredicate:118] -
Found matching value 'Donald' in attribute 'givenName'<br>
<br>
<br>
Is the "Attribute 'YYYYY' not found in context" error because my
"<bean class" syntax is not correct when the attribute is
multi-valued?<br>
<br>
I've looked but do not see or understand what the syntax should be
for a multi-valued attribute.<br>
<br>
<br>
Thanks,<br>
Don<br>
</font>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>