Empty Dependency

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

Empty Dependency

Martin Haase

Hi,

I am faced with an ERROR in the Velocity filter template of an LDAP DataConnector. The connector looks like this:

    <DataConnector id="myLDAP2" ...>
        <Dependency ref="someAttributeXYZ" />
	<FilterTemplate>
            <![CDATA[
                (member=uid=$someAttributeXYZ.get(0),dc=some,dc=domain)
            ]]>
        </FilterTemplate>

The error the templating engine spits out approximately says that there is no value for "someAttributeXYZ", so it cannot dereference its first element (ArrayIndexOutOfBoundsException). This is IdP v3.3.x.

Now I am baffled: I was under the assumption that if an attributeDefinition returns no value for an attribute, the dependent attributeDefinitions or dataConnectors would not fire in the first place. Obviously this does not seem to be the case.

I now do have a workaround that checks on $someAttributeXYZ.size() using a Velocity #if, but it is ugly because there needs to be some bogus filter string in the #else branch as well for the DataConnector to not fail.

I feel there should be something like a <Dependency ref="someAttributeXYZ" emptyisok="false" />. Am I missing something, or can this be reached via other means?

Regards,

Martin





-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: [hidden email]
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]
Reply | Threaded
Open this post in threaded view
|

RE: Empty Dependency

Rod Widdowson
> I feel there should be something like a <Dependency ref="someAttributeXYZ" emptyisok="false" />. Am
> I missing something, or can this be reached via other means?

How about an activation condition or a fallover DataConnector?

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Empty Dependency

Martin Haase
Thanks Rod,

this seems to be what I was looking for - now I've also found
https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAttributePluginActivationConditions
which I'll give a try.

Much appreciated, regards,

Martin


On 29.05.2018 10:56, Rod Widdowson wrote:
>> I feel there should be something like a <Dependency ref="someAttributeXYZ" emptyisok="false" />. Am
>> I missing something, or can this be reached via other means?
> How about an activation condition or a fallover DataConnector?
>

--
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                  
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: [hidden email]
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]
Reply | Threaded
Open this post in threaded view
|

RE: Empty Dependency

Cantor, Scott E.
In reply to this post by Martin Haase
> I feel there should be something like a <Dependency ref="someAttributeXYZ"
> emptyisok="false" />. Am I missing something, or can this be reached via other
> means?

This is why the suggestion to standardize the ability to use the data from a dependency in a dependent plugin's activation condition was brought up, and it turns out to be convenient that we always run dependencies of a plugin even if that plugin itself has a condition that tells it not to run.

But at the moment there's no fully supported way to get at the data from a dependency from within a plugin's activation condition, it's something we're looking at.

In practice, I just let the system build invalid search queries that will have predictable empty results to deal with these cases. It's a little more overhead, but my cases are not frequent.

-- Scott

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]