IDP3 - PolicyRequirementRule error in attribute filter

[Jay Fowler]

We are running a non-production instance of IdP V3.2.1 and had a question about how to properly define the PolicyRequirementRule without the legacy types. If I define it as outlined here ( https://wiki.shibboleth.net/confluence/display/IDP30/PolicyRequirementRuleConfiguration ), the attribute-filter.xml fails to load. The log shows this: 

2016-08-10 10:02:47,146 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeFilterService': Initial load failed 
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 17 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 17; columnNumber: 116; cvc-elt.4.2: Cannot resolve 'Requester' to a type definition for element 'afp:PolicyRequirementRule'. 
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334) 
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 17 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 17; columnNumber: 116; cvc-elt.4.2: Cannot resolve 'Requester' to a type definition for element 'afp:PolicyRequirementRule'. 
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399) 
Caused by: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve 'Requester' to a type definition for element 'afp:PolicyRequirementRule'. 
at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203) 

The actual PolicyRequirementRule that is throwing the error looks like this: 
<afp:PolicyRequirementRule xsi:type="Requester" value="https://my.entity.edu/shibboleth" /> 

If I use the legacy namespace ( https://wiki.shibboleth.net/confluence/display/IDP30/AttributeFilterLegacyNameSpaceMapping ), it loads but throws a warning: 

"Configuration contains at least one element in the deprecated 'urn:mace:shibboleth:2.0:afp:mf:basic' namespace." 

The filter policy that loads with the legacy namespace looks like this: 
<afp:AttributeFilterPolicy id="SHIB-SP-TST"> 

<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://my.entity.edu/shibboleth" /> 

<afp:AttributeRule attributeID="eduPersonPrincipalName"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

</afp:AttributeFilterPolicy> 

How might i define the attribute filter policy, so it makes use of the new namespace? 

INFO [net.shibboleth.idp.log.LogbackLoggingService:240] - Shibboleth IdP Version 3.2.1 

Jay 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160810/bc49fd44/attachment.html>