A confusing attribute resolver configuration

[Wessel, Keith]

Reserecting this old thread to report a config bug or possibly just a mistake on my part.

I added the Dolumn element to my LDAP data connector definition and got an error from the IDP on configuration load. Seems the XML schema doesn't like my ldapProperty elelements after my column element. If I move the column element to the end of the LDAP data connector block, though, all is well. Is this a bug? If so, I'd be glad to report it, but I wanted to make sure I'm not doing something silly first.

My log says:
2015-11-09 11:00:44,167 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 945 in XML document from file [/services/shib-idp/opt/idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 945; columnNumber: 75; cvc-complex-type.2.4.a: Invalid content was found starting with element 'dc:LDAPProperty'. One of '{"urn:mace:shibboleth:2.0:resolver:dc":Column, "urn:mace:shibboleth:2.0:resolver:dc":ResultCache, "urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.
	at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 945 in XML document from file [/services/shib-idp/opt/idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 945; columnNumber: 75; cvc-complex-type.2.4.a: Invalid content was found starting with element 'dc:LDAPProperty'. One of '{"urn:mace:shibboleth:2.0:resolver:dc":Column, "urn:mace:shibboleth:2.0:resolver:dc":ResultCache, "urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'dc:LDAPProperty'. One of '{"urn:mace:shibboleth:2.0:resolver:dc":Column, "urn:mace:shibboleth:2.0:resolver:dc":ResultCache, "urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)

...when I have the column element before the ldapProperty elements. When I move it to after the ldapProperty elemenets, all works fine.

Keith

-----Original Message-----
From: Wessel, Keith 
Sent: Wednesday, October 21, 2015 10:25 PM
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: A confusing attribute resolver configuration

Thanks, Rod and Scott. I'm actually making this config change for the next few weeks in our V2 IDP and will also be making it in our V3 IDP. I used Chris B's idea for V2, but this is much cleaner for V3.

One question: is the column element a child of the dataConnector for which I'm aliasing the attribute? That is, is it a child of my campus LDAP so that I can alias uiucEduFirstName to givenName? If it's outside of the data connector, I'm not clear how I would tell it which data connector the source attribute comes from. So, inside the data connector makes the most sense, but I wanted to make sure.

Thanks again,
Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: Wednesday, October 21, 2015 11:09 AM
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: A confusing attribute resolver configuration

Answering myself.

My answer is overly complex.  The custom schema has been extended and you
can use the <Column> child element.

 https://wiki.shibboleth.net/confluence/display/IDP30/Column

Sorry for the confusion.

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod
> Widdowson
> Sent: 21 October 2015 17:02
> To: 'Shib Users'
> Subject: RE: A confusing attribute resolver configuration
> 
> Daniel would need to confirm but it looks like you can use the
> mappingStrategyRef="bean" capability.
> 
> In V3.1.2 the bean would need to be declared like this:
> 
>     <bean id="mappings"
>
class="net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeVal
> ueMappingStrategy"
>         p:noResultAnError="true" p:multipleResultsAnError="true">
>         <property name="resultRenamingMap">
>             <map>
>                 <entry key="homephone" value="phonenumber" />
>             </map>
>         </property>
>     </bean>
> 
> Which unfortunately means using an impl (and hence subject to change)
> class
> name.
> 
> This is not a stable solution so I really cannot recommend it, but I have
> entered IDP-838 to get that fixed (and, of course, documented) in 3.2.0
> 
> /Rod
> 
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net