<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Latha;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IN" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Team,<br>
<br>
We are using LDAP data connector to get values for few of the attributes from Okta LDAP and transforming them with scripts inside
<b>attribute-resolver.xml</b>. <br>
<br>
<b>Issue statement:</b><o:p></o:p></p>
<p class="MsoNormal">If the attribute coming from LDAP Dataconnector is having data populated, our custom script is not throwing any reference error but during times the attribute is flowing with empty value from data connector, we are getting “<b><span style="background:yellow;mso-highlight:yellow">ReferenceError:
"departmentnumber" is not defined in nashorn:mozilla_compat.js at line number 69</span></b>” when our script try to get values using .getValues() method and Shibboleth is unable to determine the identity and login fails.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Note:</b> the incoming Data connector values are string <o:p>
</o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We tried few changes in the custom script to handle this error but ended up with Typerror.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below is the Attribute definition for sample attribute (defined under “<b>attribute-resolver.xml</b>”) failing with Reference error.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <AttributeDefinition id="departmentNumber"<o:p></o:p></p>
<p class="MsoNormal"> xsi:type="ScriptedAttribute"<o:p></o:p></p>
<p class="MsoNormal"> ><o:p></o:p></p>
<p class="MsoNormal"> <b><span style="background:yellow;mso-highlight:yellow"><InputDataConnector ref="oktaLDAP" attributeNames="departmentnumber" /></span><o:p></o:p></b></p>
<p class="MsoNormal"> <DisplayName>Department Number</DisplayName><o:p></o:p></p>
<p class="MsoNormal"> <DisplayDescription>Department number.</DisplayDescription><o:p></o:p></p>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML1String"<o:p></o:p></p>
<p class="MsoNormal"> name="urn:mace:dir:attribute-def:departmentNumber" /><o:p></o:p></p>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML2String"<o:p></o:p></p>
<p class="MsoNormal"> name="urn:oid:2.16.840.1.113730.3.1.2" friendlyName="departmentNumber" /><o:p></o:p></p>
<p class="MsoNormal"> <ScriptFile>%{idp.home}/conf/scripts/departmentNumber.js</ScriptFile><o:p></o:p></p>
<p class="MsoNormal"> </AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Error snippet for reference:<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2025-01-10 01:06:00,412 - DEBUG - 10.67.11.13 - [net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedIdPAttributeImpl:110] -<b> Attribute Definition 'departmentNumber': scripted attribute 'departmentNumber': values are : []</b><o:p></o:p></p>
<p class="MsoNormal">2025-01-10 01:06:00,415 - ERROR - 10.67.11.13 - [net.shibboleth.idp.profile.impl.ResolveAttributes:317] - Profile Action ResolveAttributes: Error resolving attributes<o:p></o:p></p>
<p class="MsoNormal">net.shibboleth.idp.attribute.resolver.ResolutionException: <span style="background:yellow;mso-highlight:yellow">
Attribute Definition 'departmentNumber':Script did not run successfully</span><b><span style="color:red"><o:p></o:p></span></b></p>
<p class="MsoNormal"> at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition$AttributeDefinitionScriptEvaluator.execute(ScriptedAttributeDefinition.java:228)<o:p></o:p></p>
<p class="MsoNormal">Caused by: java.lang.RuntimeException: javax.script.ScriptException:
<b><span style="background:yellow;mso-highlight:yellow">ReferenceError: "departmentnumber" is not defined in nashorn:mozilla_compat.js at line number 69</span></b><o:p></o:p></p>
<p class="MsoNormal"> at net.shibboleth.utilities.java.support.scripting.AbstractScriptEvaluator.evaluate(AbstractScriptEvaluator.java:193)<o:p></o:p></p>
<p class="MsoNormal">Caused by: javax.script.ScriptException: <span style="background:yellow;mso-highlight:yellow">
ReferenceError: "departmentnumber" is not defined in nashorn:mozilla_compat.js at line number 69</span><o:p></o:p></p>
<p class="MsoNormal"> at jdk.scripting.nashorn/jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:477)<o:p></o:p></p>
<p class="MsoNormal">Caused by: jdk.nashorn.internal.runtime.ECMAException: <b><span style="color:red;background:yellow;mso-highlight:yellow">ReferenceError: "departmentnumber" is not defined</span><span style="color:red"><o:p></o:p></span></b></p>
<p class="MsoNormal"> at jdk.scripting.nashorn/jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kindly let us know if this is a known limitation or can be handled under resolver file or script. If yes, please share the documentation or KB article link.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks and Regards<br>
Kalidasan S<br>
Advisory - Senior Solution Advisor<br>
<span lang="EN-US" style="mso-ligatures:none;mso-fareast-language:EN-IN">Cyber IAM(Okta) | Deloitte US India Risk and Financial Advisory<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-ligatures:none;mso-fareast-language:EN-IN"><a href="mailto:kalids@deloitte.com"><span style="color:#0563C1">kalids@deloitte.com</span></a> |
<a href="http://www.deloitte.com/"><span style="color:#0563C1">www.deloitte.com</span></a></span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p>This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution
of this message, or the taking of any action based on it, by you is strictly prohibited.</p>
<p>Deloitte refers to a Deloitte member firm, one of its related entities, or Deloitte Touche Tohmatsu Limited ("DTTL"). Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL does not provide services to clients. Please see www.deloitte.com/about
to learn more.</p>
<p>v.E.1</p>
</body>
</html>