Scripted Attribute Definitions, IdP V2, and Java version 1.8
In Java version 1.8 a new scripting engine (codename ‘Nashorn’) was introduced. This has some incompatibilities with the 'Rhino' scripting engine used by earlier versions. The new engine supports a language with minor syntactic differences and one major semantic difference, all of which make it impossible to ‘just upgrade’ the JVM running an IdP V2 to Java version 1.8.
This document describes two techniques to allow you to move forward.
1) Changing your Configuration to work JDKV8's 'Nashorn' engine.
Before you start
As always, make a backup of your configuration. The process of conversion will involve a certain amount of test and retest and so you should allow for downtime during which you can do this work.
Ideally, develop your changed scripts and configuration in a separate sandbox.
Description of these differences is out of scope for this article. Refer to the copious documentation available (for instance here). Suffice to say that the mechanisms by which you create Java objects have changed and whereas previously you would have:
in 1.8 you will say either
Although, as we shall see, this specific case (the creation of the output attribute) is not required
- The output attribute needs to have been created by a Static Data Connector which is declared as a dependency of the scripted attribute.
- The attribute creation is removed from the script and replaced by a line of code to remove the values added to the dummy input attribute.
It should be emphasized that the technique of inheriting existing attributes in a script and just changing the contents is supported and indeed exploited by some of the examples.
A worked example
Starting with the attribute definition:
In order to convert to Java version 1.8 we
- Add a new data connector with the dummy attribute.
- Change the script to remove the creation of the attribute and replace it with the removal of the dummy value.
- Add the new data connector as a dependency.
The final definition looks like this:
It should be noted that this particular definition works under both scripting engines since there is now no (Java) object creation.
2) Running the Rhino engine under Java 1.8
As an interim step, it is possible to make the Rhino scripting language available to an IdP running under 1.8. This is not a recommended long term strategy but it can be useful as an interim step, particularly since the two engines coexist and you can gradually move each script over from one language to another.
To install the Rhino engine into your IdP:
- Download the package from http://shibboleth.net/downloads/identity-provider/extensions/rhino-js-jdk8
- Copy the contents of the
libdirectory in the package into the
libdirectory of your distribution (there are two jars).
- Rebuild the war file.
- Do not forget to ensure that any local changes to the jsp and web.xml files are updated.
- Redeploy the war file.
- Restart the IdP.
At this stage a new scripting language “rhino-nonjdk” is available. This is the current (1.7R4) version of the Mozilla “rhino” engine. .
To make a scripted attribute be interpreted by this engine you need to change the language:
At this stage you can upgrade to Java version 1.8.