Oops, hadn't noticed this had made it over to jisc-shib. I replied to Andy 
directly, but if anyone is interested in this discussion, here's what I 
said:



> AIUI the intention is that the script
> a) goes to the directory to get a directory attribute 
eduPersonEntitlement
> b) but gets the value eduPersonAffiliation that are set locally 
> within Shibboleth
> 
> The first section is straightforward enough and  works (albeit with 
> different attribute names here).    However when we get to the 
> common-lib-terms bit it _still_ seems to be going to the directory 
> to look for an attribute called eduPersonAffiliation rather than 
> taking that from the local shibboleth value.   This causes the whole
> scriptlet to fail as eduPersonAffiliation is not a directory 
> attribute and no values are released (even if the first bit succeeds).


Nope, the intention of the script it to
a) Go to the directory to read all existing values of the entitlement 
attribute
b) Go to the directory to read the person's affiliation values, then add 
the common-lib-terms value based upon those affiliation values.

The script as-is looks at an attribute called "eduPersonAffiliation" in 
your directory and then makes the decision whether or not to add the 
common-lib-terms entitlement based on that person's affiliation value. 
Simply change the name of the attribute it's looking at to make it work 
with your directory (e.g. i'm storing eduPersonAffiliation in an attribute 
called "CardiffShibAffiliation", i'd just point it to that).

Not quite sure what you mean by "the local shibboleth value" - Shibboleth 
doesn't store any values, it can only get values from an attribute store 
or do some scripting based on such values... How are you getting the 
affiliation value to release?

R.
-- 
----------------------------------------------------------------------
Rhys Smith                                      e: [log in to unmask] 
Engineering Consultant: Identity & Access Management   (GPG:0xDE2F024C)
Information Services, 
Cardiff University,                            t: +44 (0) 29 2087 0126
39-41 Park Place, Cardiff,                     f: +44 (0) 29 2087 4285
CF10 3BB, United Kingdom.                      m: +44 (0) 7968 087 821
----------------------------------------------------------------------