Problems with parsing of attribute-filter.xml with IDP 3.2.0

FUGAGNOLI Bertrand bertrand.fugagnoli at thalesgroup.com
Thu Jul 7 11:12:04 EDT 2016 

Hi, I'm trying to deploy the lastest IDP (v3.2.0) and I got a problem with the parsing of my attribute-filter.xml file...

<?xml version="1.0" encoding="UTF-8"?>
<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
        xmlns="urn:mace:shibboleth:2.0:afp"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">

  <!--  Release the transient ID to anyone -->
    <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="transientId"><afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
        <afp:AttributeRule attributeID="myId"><afp:PermitValueRule xsi:type="basic:ANY" /></afp:AttributeRule>
        <afp:AttributeRule attributeID="myRole">    <afp:PermitValueRule xsi:type="basic:ANY" /></afp:AttributeRule>
    </afp:AttributeFilterPolicy>
</AttributeFilterPolicyGroup>

ERROR in /opt/shibboleth-idp/logs/idp-process.log
...
2016-07-07 14:26:18,103 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeFilterService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 22 in XML document from file [/opt/shibb$
        at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 22 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nest$
        at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: Le préfixe "afp" de l'élément "afp:AttributeFilterPolicy" n'est pas lié.
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)...



As the server and the system where shibboleth IDP has NO ACCESS to the Internet... I tried to adapt my "old" version which is working in an old system with an IDP v2.3.6... then I downloaded the xsd file and I put it in /opt/shibboleth-idp/schema/

My new attribute-filter.xml file is like this :

<?xml version="1.0" encoding="UTF-8"?>
<afp:AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
    xmlns="urn:mace:shibboleth:2.0:afp"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="urn:mace:shibboleth:2.0:afp classpath:/opt/shibboleth-idp/schema/shibboleth-2.0-afp.xsd">

    <!--  Release the transient ID to anyone -->
    <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="transientId"><afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
        <afp:AttributeRule attributeID="myID"><afp:PermitValueRule xsi:type="basic:ANY" /></afp:AttributeRule>
        <afp:AttributeRule attributeID="myRole">    <afp:PermitValueRule xsi:type="basic:ANY" /></afp:AttributeRule>
    </afp:AttributeFilterPolicy>

</afp:AttributeFilterPolicyGroup>



Problem : I always got errors and WARN in :

/opt/shibboleth-idp/logs/idp-process.log

2016-07-07 14:57:11,287 - WARN [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:48] - Ignored XML validation warning
org.xml.sax.SAXParseException: schema_reference.4 : Echec de la lecture du document de schéma 'classpath:/opt/shibboleth-idp/schema/shibboleth-afp.xsd' pour les raisons suivantes :$
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
Caused by: java.io.FileNotFoundException: Unable to load the resource [classpath:/opt/shibboleth-idp/schema/shibboleth-afp.xsd] using the thread context class loader or the current$
        at org.apache.catalina.webresources.ClasspathURLStreamHandler.openConnection(ClasspathURLStreamHandler.java:45)
2016-07-07 14:57:11,291 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231] - Service 'shibboleth.AttributeFilterService': Reload for shibboleth.A$
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 5 in XML document from file [/opt/shibbo$
        at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 5 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; neste$
        at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-elt.1 : Déclaration de l'élément 'AttributeFilterPolicyGroup' introuvable.
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)



/opt/shibboleth-idp/logs/idp-warn.log

2016-07-07 14:57:11,287 - WARN [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:48] - Ignored XML validation warning
org.xml.sax.SAXParseException: schema_reference.4 : Echec de la lecture du document de schéma 'classpath:/opt/shibboleth-idp/schema/shibboleth-afp.xsd' pour les raisons suivantes :$
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
Caused by: java.io.FileNotFoundException: Unable to load the resource [classpath:/opt/shibboleth-idp/schema/shibboleth-afp.xsd] using the thread context class loader or the current$
        at org.apache.catalina.webresources.ClasspathURLStreamHandler.openConnection(ClasspathURLStreamHandler.java:45)
2016-07-07 14:57:11,291 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231] - Service 'shibboleth.AttributeFilterService': Reload for shibboleth.A$
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 5 in XML document from file [/opt/shibbo$
        at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 5 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; neste$
        at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-elt.1 : Déclaration de l'élément 'AttributeFilterPolicyGroup' introuvable.
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)



So please, where do I have to put shibboleth-afp.xsd file to have my attribute-filter.xml file parsed correctly ?


Bertrand Fugagnoli
[@@OPEN@@]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160707/65f71675/attachment-0001.html>

More information about the users mailing list