InCommon RelyingPartyOverride in IdP 3.2.1

[brabec at ncsu.edu]

Per this only thread:
http://shibboleth.net/pipermail/users/2015-May/021553.html

We also have the issue of using a URL entityID for most things, but a
URN entityID for Incommon (and soon to be eduGAIN.) I was able to get an
override to work, but it doesn't seem to work the way that I expect.

We use the default DefaultRelyingParty. 

----code----
    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
            </list>
        </property>
    </bean>
----code----

This Override works, but only because I duplicated all the 
profileConfigurations from the default. It doesn't appear to inherit.

----code----
    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByGroup" c:groupNames="urn:mace:incommon">
            <property name="responderId" value="urn:mace:incommon:ncsu.edu"/>
            <property name="profileConfigurations">
                <list>
                    <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
                    <ref bean="SAML1.AttributeQuery" />
                    <ref bean="SAML1.ArtifactResolution" />
                    <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
                    <ref bean="SAML2.ECP" />
                    <ref bean="SAML2.Logout" />
                    <ref bean="SAML2.AttributeQuery" />
                    <ref bean="SAML2.ArtifactResolution" />
                </list>
            </property>
        </bean>
    </util:list>
----code----

In other words, this doesn't work, but I thought it should:

----code----
    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByGroup" c:groupNames="urn:mace:incommon">
            <property name="responderId" value="urn:mace:incommon:ncsu.edu"/>
        </bean>
    </util:list>
----code----

It puts this into my idp-process.log:

WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for relying party configuration EntityGroups[urn:mace:incommon,]

Did I miss something to tell the override to use the defaults when 
profileConfigurations are not specified? The examples seem to suggest 
that's how it works. 

Thanks for any guidance,
Charles

-- 
All electronic mail messages in connection with State business which are
sent to or received by this account are subject to the NC Public Records Law
and may be disclosed to third parties.