Internation dateline issue

[Mike Flynn]

OK, adding this:

<RelyingParty Name="https://fidp.usc.edu.au/idp/shibboleth" keyName="AAF"/>

<CredentialResolver type="Chaining">
             <CredentialResolver type="File" keyName="Active" use="encryption"
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/>
             <CredentialResolver type="File" keyName="AAF" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-AAF.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-AAF.pem"/>
        </CredentialResolver>

Generates this error:

2013-01-23 06:19:51 ERROR XMLTooling.ParserPool : error on line 438, column 28, message: element 'RelyingParty' is not allowed for content model '((Sessions,Errors,RelyingParty,Notify,Audience,MetadataProvider,TrustEngine,AttributeExtractor,AttributeResolver,AttributeFilter,CredentialResolver),ApplicationOverride)'


Oddly, my test SP that mirrors prod did not generate this error...  Even after copying etc/shibboleth2.xml from prod to the test machine...  Googled that error - not much out there...



________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Tuesday, January 22, 2013 6:11 PM
Subject: Re: Internation dateline issue
 
On 1/22/13 8:51 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>So, for each member coming through this fed, I have to add a new relying
>party rule?  I can't match on .edu.au as other schools need to come in as
>private feds.

There's no way for the code to know what certificate it's supposed to use.

That's why this is such a bad model. When federations dictate credentials,
things don't work well.

But as I said, SAML 2 means no queries which means you don't need a
signing certificate. Unless you sign requests.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130123/cc834771/attachment.html