<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">Hello all, </span></div><div><br data-mce-bogus="1"></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">I have an instance of Shibboleth IDP v4 freshly installed and running and i need to define an attribute with a scripted attribute type.</span></div><p>For context: I need to define and send some specific attribute for my SP: firstname, lastname, mail and group for a given user.</p><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">I managed to get almost all of them with this configuration:</span></div><blockquote><pre></AttributeResolver><br>[...]<br><AttributeDefinition id="Firstname" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="givenName"/> <AttributeEncoder xsi:type="SAML2String" name="firstname"/> </AttributeDefinition><br><AttributeDefinition id="Lastname" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="sn"/> <AttributeEncoder xsi:type="SAML2String" name="lastname"/> </AttributeDefinition><br><AttributeDefinition id="Groups" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="gidNumber"/> <AttributeEncoder xsi:type="SAML2String" name="groups"/> </AttributeDefinition><br><AttributeDefinition id="Mail" xsi:type="Simple"> <InputDataConnector ref="myLDAP" attributeNames="mail"/> <AttributeEncoder xsi:type="SAML2String" name="mail"/> </AttributeDefinition><br><br><DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br> exportAttributes="uid mail gidNumber sn givenName"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br></DataConnector><br></AttributeResolver><br></pre></blockquote><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;"> <!--StartFragment--></span></span><p data-mce-style="color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" style="color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span data-mce-style="font-family: arial, helvetica, sans-serif;" style="font-family: arial, helvetica, sans-serif;">As you cans see,i get the gidNumber because my ldap doesn't send the gid only in an non numerical way. <br></span>And it is not what i really need, so i thought about use a Scripted Attribute to get my group name in a more human readable thing than a gidNumber.</p></div><p><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">My starting point was to do somethin equivalent to the unix command "<em>id -gn uid</em>" to get the gid in all letter for a given uid.</span></p><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">I read this page <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631560/ScriptedAttributeDefinition">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631560/ScriptedAttributeDefinition</a> but i didn't find a way to modifiy my uid attribute with a JSR 223 script with the avalaible class in the documentation.</span><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;"></span></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">So i though about using system functions. Frst i though of writing some java script and only use the function in my scripted attribute, but i didn't find if it is possible to point a path to a script in a attribute definition.</span></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;"><br data-mce-bogus="1"></span></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">Then, I tried this and it didn't work (i must add that i have absolutetly no knowledge about java language so this is IA generated, sorry about that):</span></div><div><span style="" data-mce-style="font-family: arial, helvetica, sans-serif;"><div style=""><blockquote><pre><AttributeDefinition id="group" xsi:type="ScriptedAttribute"><br><InputDataConnector ref="MyLDAP" attributeNames="uid" /><br><Script><![CDATA[<br>import java.io.*;<br>def executeCommand(String command) {<br>def process = command.execute()<br>process.waitFor()<br>return process.in.text.trim()<br>}<br>var uid = uid.get(0);<br>var command = "id -gn " + uid;<br>var groupName = executeCommand(command);<br>if (groupName != null && !groupName.isEmpty()) {<br>var attribute = new javax.naming.directory.BasicAttribute("group", groupName);<br>return [attribute];<br>} else {<br>return [];<br>}<br>]]></Script><br></AttributeDefinition></pre></blockquote></div></span></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">The error log was pretty clear that i didn't use the Script part like intended: </span></div><div><span style="" data-mce-style="font-family: arial, helvetica, sans-serif;"><div style=""><blockquote><pre>Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'group': Cannot create inner bean '(inner bean)#4017cc34' of type [net.shibboleth.ext.spring.factory.EvaluableScriptFactoryBean] while setting bean property 'script'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#4017cc34': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: javax.script.ScriptException: <eval>:1:0 Expected an operand but found import<br>import java.io.*;<br>^ in <eval> at line number 1 at column number 0</pre></blockquote></div><div style=""><span style="" data-mce-style="font-family: arial, helvetica, sans-serif;">So i thought maybe i am doing this the wrong way and try to made something more complicated than needed.</span></div><div style=""><span style="" data-mce-style="font-family: arial, helvetica, sans-serif;"><span style="" data-mce-style="font-family: arial, helvetica, sans-serif;"><br data-mce-bogus="1"></span></span></div></span></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;">Is anyone who had the same need for an ldap attribute? Do i miss something crucial in the documentation that can permit an easy attribute definition?</span></div><div><span style="font-family: arial, helvetica, sans-serif;" data-mce-style="font-family: arial, helvetica, sans-serif;"><br data-mce-bogus="1"></span></div><div>May thanks and best regards, </div><div><br data-mce-bogus="1"></div><div>Emilie</div></div></body></html>