Activation condition by Relying Party on NameID generators for IdPv3

[Michael A Grady]

I'm working with the new NameID config in v3 for the first time (had left it to legacy format in the resolver before). I know there has been at least one thread related to specifying activation conditions, and what syntax(es) were working now and which weren't. I was trying to do so, and I don't get an error at startup, but I do seem to get an error when it goes to actually use it. What I tried was, for a couple of shibboleth.SAML2AttributeSourcedGenerator entries:

                 <property name="activationCondition">
                        <bean parent="shibboleth.Conditions.RelyingPartyId"
                         c:candidates="#{ {'relyingpartyX', 'relyingpartyY'} }" />
                </property>

....

                <property name="activationCondition">
                        <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="relyingpartyz" />
                </property>

If I remove the above, everything works as expected. So at least one it doesn't like. Now I know I also saw the config for doing an OR with a list, although the 'candidates' versus 'candidate' seemed like it might take a list. So is it trying having multiple for 'candidates', or is it that a single candidate needs to still have the  #{ {'relyingpartyz'} } syntax, or ?


https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions

--
Michael A. Grady
IAM Architect, Unicon, Inc.