attribute filter rule "PermitValueRule" not working

[Kent Nasveschuk]

Hello, 
My installation: Shibboleth IDP 2.3.7 
I've been wrestling with this and can't seem to get it to work, restrict values to what is below. We use 1 other value "none". 

This filter policy is in a single policy group 


... 
<afp:AttributeFilterPolicy id="releaseSpecificAttributes"> 
<afp:PolicyRequirementRule xsi:type="basic:ANY"/> 
<afp:AttributeRule attributeID="eduPersonAffiliation"> 
<afp:PermitValueRule xsi:type="basic:OR" > 
<basic:Rule xsi:type="basic:AttributeValueString" value="faculty" ignoreCase="true"/> 
<basic:Rule xsi:type="basic:AttributeValueString" value="student" ignoreCase="true"/> 
<basic:Rule xsi:type="AttributeValueString" value="staff" ignoreCase="true" /> 
<basic:Rule xsi:type="AttributeValueString" value="alum" ignoreCase="true" /> 
<basic:Rule xsi:type="AttributeValueString" value="member" ignoreCase="true" /> 
<basic:Rule xsi:type="AttributeValueString" value="affiliate" ignoreCase="true" /> 
<basic:Rule xsi:type="AttributeValueString" value="employee" ignoreCase="true" /> 
<basic:Rule xsi:type="AttributeValueString" value="library-walk-in" ignoreCase="true" /> 
</afp:PermitValueRule> 
</afp:AttributeRule> 
</afp:AttributeFilterPolicy> 
... 

idp-process.log on startup ... 

09:46:40.325 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components. The root cause of this error was: org.springframework.beans.factory.BeanCreationException: RuleReference elements within an AND rule are not supported 


This works fine: 

<afp:AttributeRule attributeID="eduPersonAffiliation"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

Any help would be appreciated, pulling what little hair I have left out!! 

Kent 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130701/f7ddb583/attachment.html