SAML2ECPProfile problems

[Michael Dahlberg]

I'm trying to configure our IdP to work with a third-party SP (ArcGIS
Online, if that's of concern).  Their instructions state the following:


   1. Turn off assertion encryption in the Shibboleth IdP.

   ArcGIS Online does not support encrypted SAML assertions from the
   identity providers, so you need to turn off assertion encryption in
   Shibboleth.

   To turn off assertion encryption, open the
   SHIBBOLETH_HOME/conf/relying-party.xml file and within the
   <DefaultRelyingParty>"saml: SAML2SSOProfile" section, change the value
   of encryptAssertions to never.

   <rp:DefaultRelyingParty provider="https://grid3.esri.com/idp/shibboleth"
   defaultSigningCredentialRef="IdPCredential">
   ...
        <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
includeAttributeStatement="true"
                                    assertionLifetime="PT5M"
assertionProxyCount="0"
                                    signResponses="never"
signAssertions="always"
                                    encryptAssertions="never"
encryptNameIds="never"/>
   ...
   </rp:DefaultRelyingParty>



My first issue is that it seems to be talking about two different
profiles:  SAML2SSOProfile and SAML2ECPProfile.  I assumed it meant make
the changes to the SAML2ECPProfile and I added the following to my
relying-party.xml file within the DeffaultRelyingParty section:

<rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
                              includeAttributeStatement="true"
                              assertionLifetime="PT5M"
                              assertionProxyCount="0"
                              signResponses="never"
                              signAssertions="always"
                              encryptAssertions="never"
                              encryptNameIds="never" />

However, when I restart tomcat I get the error

14:02:13.259 - ERROR
[edu.internet2.middleware.shibboleth.common.config.BaseService:187] -
Configuration was not loaded for
shibboleth.RelyingPartyConfigurationManager service, error creating
components.  The root cause of this error was:
org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve
'saml:SAML2ECPProfile' to a type definition for element
'rp:ProfileConfiguration'.

which results in a host of java errors.  I have not modified the
handler.xml file and as such there is no SAML2ECPProfile section in that
file.  However, since that file is so rarely modified, I did not think that
was the root cause.

Any help or suggestions you could provide will be greatly appreciated.

Mike

-- 
#####################
Michael Dahlberg
Systems Integrator
Bucknell University
(570) 577-1595
#####################
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140317/ef865665/attachment-0001.html