LDAPProperty on attribute-resolver

[Daniel McDonald]

Hi,

Im upgrading our IdP from v2 to v3. I've modified ldap.properties and 
ldap-auth.config to check multiple OU's based on the examples in the 
docs. So I have idp.authn.LDAP.baseDN1 through idp.authn.LDAP.baseDN4 
and the same goes for most of the other things in ldap.properties.

Thats a problem when it reads the dataconnector in attribute-resolver 
though, by default theres a call to 1 server. I saw on the 
DataConnectorConfiguration 
<https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration#DataConnectorConfiguration-%3CFailoverDataConnector%3E> 
doc that <FailoverDataConnector> is still supported, so I thought I 
could basically replicate what I have on my v2 server but I get this 
error about <LDAPProperty>. It looks like a syntax error but I cant find 
anything wrong. Is there another way I should be doing this?

net.shibboleth.utilities.java.support.service.ServiceException: 
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: 
Line 131 in XML document from file 
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested 
exception is org.xml.sax.SAXParseException; lineNumber: 131; 
columnNumber: 64; cvc-complex-type.2.4.a: Invalid content was found 
starting with element 'dc:LDAPProperty'. One of 
'{"urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential, 
"urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool, 
"urn:mace:shibboleth:2.0:resolver:dc":Column, 
"urn:mace:shibboleth:2.0:resolver:dc":ResultCache, 
"urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.
     at 
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: 
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: 
Line 131 in XML document from file 
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested 
exception is org.xml.sax.SAXParseException; lineNumber: 131; 
columnNumber: 64; cvc-complex-type.2.4.a: Invalid content was found 
starting with element 'dc:LDAPProperty'. One of 
'{"urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential, 
"urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool, 
"urn:mace:shibboleth:2.0:resolver:dc":Column, 
"urn:mace:shibboleth:2.0:resolver:dc":ResultCache, 
"urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.
     at 
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: 
Invalid content was found starting with element 'dc:LDAPProperty'. One 
of 
'{"urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential, 
"urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool, 
"urn:mace:shibboleth:2.0:resolver:dc":Column, 
"urn:mace:shibboleth:2.0:resolver:dc":ResultCache, 
"urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.
     at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)

This is the dataconnector from attribute-resolver, its followed by 
another dataconnector but instead of ldapURL1 it has ldapURL2 and so on.

  <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
         ldapURL="%{idp.attribute.resolver.LDAP.ldapURL1}"
         baseDN="%{idp.attribute.resolver.LDAP.baseDN1}"
         principal="%{idp.attribute.resolver.LDAP.bindDN1}"
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential1}"
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS1::true}">

         <resolver:FailoverDataConnector ref="myLDAP2" />

         <dc:FilterTemplate>
             <![CDATA[
                 %{idp.attribute.resolver.LDAP.searchFilter}
             ]]>
         </dc:FilterTemplate>
<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
         <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" 
xsi:type="sec:X509ResourceBacked">
<sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
         </dc:StartTLSTrustCredential>

         <dc:LDAPProperty name="java.naming.referral" value="follow"/>

     </resolver:DataConnector>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160822/972c2c35/attachment.html>