attribute filter rule "PermitValueRule" not working

[Kent Nasveschuk]

Here is the entire attribute-filter.xml: 

<?xml version="1.0" encoding="UTF-8"?> 
<afp:AttributeFilterPolicyGroup id="ShibbolethFilterPolicy" 
xmlns:afp="urn:mace:shibboleth:2.0:afp" xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic" 
xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp classpath:/schema/shibboleth-2.0-afp.xsd 
urn:mace:shibboleth:2.0:afp:mf:basic classpath:/schema/shibboleth-2.0-afp-mf-basic.xsd 
urn:mace:shibboleth:2.0:afp:mf:saml classpath:/schema/shibboleth-2.0-afp-mf-saml.xsd"> 

<!-- Release the transient ID to anyone --> 
<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone"> 
<afp:PolicyRequirementRule xsi:type="basic:ANY"/> 

<afp:AttributeRule attributeID="transientId"> 
<afp:PermitValueRule xsi:type="basic:ANY"/> 
</afp:AttributeRule> 
<afp:AttributeRule attributeID="eduPersonScopedAffiliation"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 
</afp:AttributeFilterPolicy> 


<afp:AttributeFilterPolicy id="releaseSpecificAttributes"> 
<afp:PolicyRequirementRule xsi:type="basic:ANY"/> 
<afp:AttributeRule attributeID="eduPersonAffiliation"> 
<afp:PermitValueRule xsi:type="basic:OR" > 
<basic:Rule xsi:type="basic:AttributeValueString" value="faculty" ignoreCase="true"/> 
<basic:Rule xsi:type="basic:AttributeValueString" value="student" ignoreCase="true"/> 
<basic:Rule xsi:type="basic:AttributeValueString" value="staff" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="alum" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="member" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="affiliate" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="employee" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="library-walk-in" ignoreCase="true" /> 
</afp:PermitValueRule> 
</afp:AttributeRule> 
</afp:AttributeFilterPolicy> 

</afp:AttributeFilterPolicyGroup> 


Returns this error message: 

12:13:56.927 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:72] - Parsing configuration for attribute filter policy releaseTransientIdToAnyone 
12:13:56.938 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:72] - Parsing configuration for attribute filter policy releaseSpecificAttributes 
12:13:56.941 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components. The root cause of this error was: org.springframework.beans.factory.BeanCreationException: RuleReference elements within an AND rule are not supported 

I don't see where the problem is. 


----- Original Message -----

From: "Scott Cantor" <cantor.2 at osu.edu> 
To: "Shib Users" <users at shibboleth.net> 
Sent: Monday, July 1, 2013 11:26:26 AM 
Subject: RE: attribute filter rule "PermitValueRule" not working 

> <afp:AttributeFilterPolicy id="releaseSpecificAttributes"> 
> <afp:PolicyRequirementRule xsi:type="basic:ANY"/> 
> <afp:AttributeRule attributeID="eduPersonAffiliation"> 
> <afp:PermitValueRule xsi:type="basic:OR" > 
> <basic:Rule xsi:type="basic:AttributeValueString" value="faculty" 
> ignoreCase="true"/> 
> <basic:Rule xsi:type="basic:AttributeValueString" value="student" 
> ignoreCase="true"/> 
> <basic:Rule xsi:type="AttributeValueString" value="staff" 
> ignoreCase="true" /> 

Well, I suspect that might not work unless the default namespace is the one corresponding to "basic", but that isn't the error you showed. 

> idp-process.log on startup ... 
> 
> 09:46:40.325 - ERROR 
> [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - 
> Configuration was not loaded for shibboleth.AttributeFilterEngine service, 
> error creating components. The root cause of this error was: 
> org.springframework.beans.factory.BeanCreationException: RuleReference 
> elements within an AND rule are not supported 

That should be self-explanatory, you have an AND rule you didn't show, and it's got a RuleReference inside, which wasn't handled by the code, so isn't supported. 

-- Scott 

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130701/c7f3f2d4/attachment.html