<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">Solved. Was mocking up
this postAuth flow on a second Shib IdP server we use for non
production testing stuff.<br>
<br>
As I mentioned in the original post, the
eduPersonScopedAffiliation attribute was defined as:<br>
<br>
</font><br>
<font face="Helvetica, Arial, sans-serif"><font face="Helvetica,
Arial, sans-serif"> <AttributeDefinition xsi:type="Scoped"
id="eduPersonScopedAffiliation" scope="jmu.edu"><br>
<InputDataConnector ref="oud" attributeNames="<b>eduPersonAffiliation</b>"/><br>
<AttributeEncoder xsi:type="SAML2ScopedString"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
friendlyName="eduPersonScopedAffiliation" /><br>
</AttributeDefinition><br>
<br>
The issue was, in our LDAP directory, the </font></font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial,
sans-serif"><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif"><b>eduPersonAffiliation
</b></font></font>attribute is al lower case: </font></font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial,
sans-serif"><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif"><b>edupersonaffiliation</b></font></font>.<br>
<br>
Case does matter. This case issues was not on our production IdP
server.<br>
<br>
Once I found that and resolved it, my post auth bean works as I
expected.<br>
<br>
Thanks,<br>
Don<br>
<br>
</font></font><br>
<div class="moz-cite-prefix">On 5/14/22 3:48 PM, Cantor, Scott via
users wrote:<br>
</div>
<blockquote type="cite" cite="mid:1531DE24-B939-4C8F-80F0-E84F209F1E1D@osu.edu">
<pre class="moz-quote-pre" wrap="">CAUTION: This email originated from outside of JMU. Do not click links or open attachments unless you recognize the sender and know the content is safe.
________________________________
As Rod said, you're going to have issues with those Predicates when values are scoped (4.2 adds options to them to handle that), but the messages suggest that the attributes simple aren't there. They're not multi-valued, they're absent.
That's not a timing thing (they'd be there by this point), it's a "the data's not there" thing.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> I've looked but do not see or understand what the syntax should be for a multi-valued attribute.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
The predicates don't care how many values exist, they check each one. They can't check something that's not there. The predicates have an option for controlling what they do in that situation as well.
The Javadocs for them cover the options, including the addition of a scope setting to check for.
-- Scott
--
For Consortium Member technical support, see <a class="moz-txt-link-freetext" href="https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=SToYJDLhNCxpK7GDpoeFPtZvuJBGU0XUnqc3vysbpiU&s=SIukdBfvG4Bth_4Wd3pB77DEN4wMdoA6tFHWFzo_aAY&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=SToYJDLhNCxpK7GDpoeFPtZvuJBGU0XUnqc3vysbpiU&s=SIukdBfvG4Bth_4Wd3pB77DEN4wMdoA6tFHWFzo_aAY&e=</a>
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>