attribute filter rule "PermitValueRule" not working

[Kent Nasveschuk]

more abbreviated file: 
<?xml version="1.0" encoding="UTF-8"?> 
<afp:AttributeFilterPolicyGroup id="ShibbolethFilterPolicy" 
xmlns:afp="urn:mace:shibboleth:2.0:afp" xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic" 
xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp classpath:/schema/shibboleth-2.0-afp.xsd 
urn:mace:shibboleth:2.0:afp:mf:basic classpath:/schema/shibboleth-2.0-afp-mf-basic.xsd 
urn:mace:shibboleth:2.0:afp:mf:saml classpath:/schema/shibboleth-2.0-afp-mf-saml.xsd"> 

<afp:AttributeFilterPolicy id="releaseSpecificAttributes"> 
<afp:PolicyRequirementRule xsi:type="basic:ANY"/> 
<afp:AttributeRule attributeID="eduPersonAffiliation"> 
<afp:PermitValueRule xsi:type="basic:OR" > 
<basic:Rule xsi:type="basic:AttributeValueString" value="faculty" ignoreCase="true"/> 
<basic:Rule xsi:type="basic:AttributeValueString" value="student" ignoreCase="true"/> 
<basic:Rule xsi:type="basic:AttributeValueString" value="staff" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="alum" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="member" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="affiliate" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="employee" ignoreCase="true" /> 
<basic:Rule xsi:type="basic:AttributeValueString" value="library-walk-in" ignoreCase="true" /> 
</afp:PermitValueRule> 
</afp:AttributeRule> 
</afp:AttributeFilterPolicy> 

</afp:AttributeFilterPolicyGroup> 



same error message :( 

14:33:48.233 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:180] - shibboleth.AttributeResolver service loaded new configuration 
14:33:48.237 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new configuration for service shibboleth.AttributeFilterEngine 
14:33:48.253 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:72] - Parsing configuration for attribute filter policy releaseSpecificAttributes 
14:33:48.266 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components. The root cause of this error was: org.springframework.beans.factory.BeanCreationException: RuleReference elements within an AND rule are not supported 


----- Original Message -----

From: "Paul Hethmon" <paul.hethmon at clareitysecurity.com> 
To: "Shib Users" <users at shibboleth.net> 
Sent: Monday, July 1, 2013 2:27:53 PM 
Subject: Re: attribute filter rule "PermitValueRule" not working 

One thing to try is to remove all the rules in attribute-filter.xml and then slowly add them in until you get the error message. Your file was pretty small, it wouldn't take long. 

Paul 

From: Kent Nasveschuk < knasveschuk at mbl.edu > 
Reply-To: Shibboleth Users < users at shibboleth.net > 
Date: Monday, July 1, 2013 2:21 PM 
To: Shibboleth Users < users at shibboleth.net > 
Subject: Re: attribute filter rule "PermitValueRule" not working 

I just got 2.3.7 running, I can try on 2.4 but won't be for a while. I have a way around for my purposes right now, but that would sure come in handy. 

I also tried "DenyValueRule", didn't work either, different error message. I only have 1 value to exclude, so it would be simpler to to use that. 

Will keep hunting... 

----- Original Message -----

From: "Scott Cantor" < cantor.2 at osu.edu > 
To: "Shib Users" < users at shibboleth.net > 
Sent: Monday, July 1, 2013 1:44:36 PM 
Subject: RE: attribute filter rule "PermitValueRule" not working 

> I don't see where the problem is. 

I have to think that's not the file it's really using, or there's a second filter policy file configured. 

Or I suppose there's some weird config parsing issue, so if you can reproduce on 2.4, we can certainly take a bug report if that same file produces that error. 

-- Scott 

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130701/5cf9d844/attachment.html