When using the SimpleAttributePredicate with a wildcard match, NULL attributes that get mapped as EmptyAttributeValue(s) erroneously return true. Wildcard testing on an attribute of EmptyAttributeValue should return false.

The following bean was used for testing this conditions:

The following log line demonstrates that the mail attribute (a SQL NULL value in the connected data store for the test individual) is pulled from the connector as an EmptyAttrbuteValue:

Later, the predicate logs the following:

This seems to be because the hasMatch method of the SimpleAttributePredicate, line 97, loops through all available attributes in the context without checking for EmptyAttributeValues, and calls findMatch.

Later, in the findMatch method, lines 122 - 124, if the toMatch parameter is the wildcard character ("*"), it returns true without inspecting the attribute value to check for EmptyAttributeValues.

I've tagged this as AttributeMapper and AttributeResolver, neither of which seems like an exact match (since predicates and activation conditions weren't available), so feel free to re-categorize as is appropriate.