Shibboleth Developers

[Markus Ludwig Grandpre <>]

> There are methods in the plugin base class for accessing dependendent results:
>
> getValuesFromAllDependencies
>
> getValuesFromAttributeDependency
>
> getValuesFromConnectorDependency
>
> In fairness they take the context as a parameter, but I would at 
least use those methods first and see what happens.
>

All methods do return null values.

> > But every time only one AttributeDefinition object is returned, although
> > I've defined three different AttributeDefinitions elements in
> > attribute-resolver.xml.
>
> And each one is listed in your plugin's XML as a dependency of your plugin?

These are my element definition in attribute-resolver.xml so far:

<resolver:AttributeDefinition
  id="eduPersonEntitlement"
  xsi:type="Simple"
  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
  sourceAttributeID="eduPersonEntitlement">
  <resolver:Dependency ref="myShibboleth" />
  <resolver:AttributeEncoder
   xsi:type="SAML1String"
   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
   name="urn:mace:dir:attribute-def:eduPersonEntitlement" />
  <resolver:AttributeEncoder
   xsi:type="SAML2String"
   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
   name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7"
   friendlyName="eduPersonEntitlement" />
 </resolver:AttributeDefinition>

 <resolver:AttributeDefinition
  id="eduPersonPrincipalName"
  xsi:type="Simple"
  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
  sourceAttributeID="cn">
  <resolver:Dependency ref="myShibboleth" />
  <resolver:AttributeEncoder
   xsi:type="SAML1ScopedString"
   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
   name="urn:mace:dir:attribute-def:eduPersonPrincipalName" />
  <resolver:AttributeEncoder
   xsi:type="SAML2ScopedString"
   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
   name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
   friendlyName="eduPersonPrincipalName" />
 </resolver:AttributeDefinition>

 <resolver:AttributeDefinition
  id="eduPersonScopedAffiliation"
  xsi:type="Scoped"
  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
  scope="uni-konstanz.de"
  sourceAttributeID="eduPersonAffiliation">
  <resolver:Dependency ref="myShibboleth" />
  <resolver:AttributeEncoder
   xsi:type="SAML1ScopedString"
   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
   name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" />
  <resolver:AttributeEncoder
   xsi:type="SAML2ScopedString"
   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
   name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
   friendlyName="eduPersonScopedAffiliation" />
 </resolver:AttributeDefinition>

 <resolver:DataConnector
  id="myShibboleth"
  xsi:type="MyShibbolethDataConnector"
  xmlns="urn:mace:unikn:shibboleth:resolver"
  attr1="test"/>

> You keep saying it backwards, and that makes one naturally suspicious of your 
> configuration. It may well just be a misspeak, but the difference matters. 
> The LDAP connector does NOT get all the attributes, the plugins that depend 
> on the LDAP connector are provided with the LDAP result.

Maybe a mispell. But from my point of view I'm implementing a 
DataConnector that has access to all available AttributeDefinition 
objects that define a DataConnector as an dependency object (but I'm 
learning to see the other way round).

> What does the DEBUG log indicator about the dependent attribute plugins? Are 
> they properly initialized and do they run successfully?

That's what idp-process.log says:

17:39:35.193 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:135] 
- Initializing shibboleth.A
ttributeResolver service with resources: 
[/opt/shibboleth-idp-2.1.0/conf/attribute-resolver.xml]
17:39:35.194 - INFO 
[edu.internet2.middleware.shibboleth.common.config.BaseService:157] - 
Loading configuration for service: s
hibboleth.AttributeResolver
17:39:35.243 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for PrincipalConnector plugin with 
ID: shibTransient
17:39:35.244 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin shibTransient: null
17:39:35.244 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for PrincipalConnector plugin with 
ID: saml1Unspec
17:39:35.244 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin saml1Unspec: null
17:39:35.245 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for PrincipalConnector plugin with 
ID: saml2Transient
17:39:35.245 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin saml2Transient: null
17:39:35.452 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for DataConnector plugin with ID: 
myShibboleth
17:39:35.452 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin myShibboleth: null
17:39:35.558 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for AttributeDefinition plugin with 
ID: eduPersonEntitlement
17:39:35.559 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin eduPersonEntitlement: [myShibboleth]
17:39:35.559 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDe
finitionBeanDefinitionParser:57] - Setting source attribute ID for 
attribute definition eduPersonEntitlement to: eduPersonEnti
tlement
17:39:35.560 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDe
finitionBeanDefinitionParser:81] - Attribute definition 
eduPersonEntitlement produces attributes that are only dependencies: f
alse
17:39:35.573 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for AttributeDefinition plugin with 
ID: eduPersonPrincipalName
17:39:35.573 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin eduPersonPrincipalName: [myShibboleth]
17:39:35.574 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDe
finitionBeanDefinitionParser:57] - Setting source attribute ID for 
attribute definition eduPersonPrincipalName to: cn
17:39:35.574 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDe
finitionBeanDefinitionParser:81] - Attribute definition 
eduPersonPrincipalName produces attributes that are only dependencies:
 false
17:39:35.577 - INFO 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefiniti
onParser:54] - Parsing configuration for AttributeDefinition plugin with 
ID: eduPersonScopedAffiliation
17:39:35.578 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinit
ionParser:60] - Setting the following attribute definition dependencies 
for plugin eduPersonScopedAffiliation: [myShibboleth]
17:39:35.578 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDe
finitionBeanDefinitionParser:57] - Setting source attribute ID for 
attribute definition eduPersonScopedAffiliation to: eduPers
onAffiliation
17:39:35.578 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDe
finitionBeanDefinitionParser:81] - Attribute definition 
eduPersonScopedAffiliation produces attributes that are only dependenc
ies: false
17:39:35.579 - DEBUG 
[edu.internet2.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.ScopedAttribute
DefinitionBeanDefinitionParser:52] - Setting scope of attribute 
definition eduPersonScopedAffiliation to: uni-konstanz.de
17:39:35.649 - DEBUG 
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:479] 

- Loading 1 data connectors
17:39:35.649 - DEBUG 
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:489] 

- Loading 3 attribute definitions
17:39:35.650 - DEBUG 
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:499] 

- Loading 3 principal connectors

To me all plugins seem to be properly initialized. What do you see?

Markus