attribute filter rule "PermitValueRule" not working

[Cantor, Scott]

>    <afp:AttributeFilterPolicy id="releaseSpecificAttributes">
>         <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
>         <afp:AttributeRule attributeID="eduPersonAffiliation">
>             <afp:PermitValueRule xsi:type="basic:OR" >
>                 <basic:Rule xsi:type="basic:AttributeValueString" value="faculty"
> ignoreCase="true"/>
>                 <basic:Rule xsi:type="basic:AttributeValueString" value="student"
> ignoreCase="true"/>
>                 <basic:Rule xsi:type="AttributeValueString" value="staff"
> ignoreCase="true" />

Well, I suspect that might not work unless the default namespace is the one corresponding to "basic", but that isn't the error you showed.

> idp-process.log on startup ...
> 
> 09:46:40.325 - ERROR
> [edu.internet2.middleware.shibboleth.common.config.BaseService:188] -
> Configuration was not loaded for shibboleth.AttributeFilterEngine service,
> error creating components.  The root cause of this error was:
> org.springframework.beans.factory.BeanCreationException: RuleReference
> elements within an AND rule are not supported

That should be self-explanatory, you have an AND rule you didn't show, and it's got a RuleReference inside, which wasn't handled by the code, so isn't supported.

-- Scott