v2->v3 upgrade, google apps

[Baron Fujimoto]

I'm at the point now in our IdP v2->v3 upgrade where I think it's
basically working, except for Google Apps.

Our upgraded legacy v2 config was generating an "Invalid Email" error from
Google after authenticating. Searches turned up the following representative
thread that suggested a solution:

<http://shibboleth.1660669.n2.nabble.com/Google-Apps-with-IdPv3-td7612963.html>

So I added the following to relying-party.xml:
=====
    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByName" c:relyingPartyIds="google.com">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>
    </util:list>
=====
(and compensating for the missing util:list bindings missing from the ugraded
legacy v2 relying-party.xml)

and in saml-nameid.xml:
=====
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'principal'} }" />

    </util:list>
=====

But I am now getting the following error:

ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 134 in XML document from file [/home/shib/idp/conf/relying-party.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 134; columnNumber: 54; cvc-complex-type.2.4.a: Invalid content was found starting with element 'util:list'. One of '{"urn:mace:shibboleth:2.0:relying-party":RelyingParty, "urn:mace:shibboleth:2.0:metadata":MetadataProvider, "urn:mace:shibboleth:2.0:security":Credential, "urn:mace:shibboleth:2.0:security":TrustEngine, "urn:mace:shibbo
leth:2.0:security":SecurityPolicy}' is expected.

Is this because the the upgraded legacy relying-party.xml is using v2
compatibility and thus the added bean config is not available? Does this
mean the v2 compatible relying-party.xml must be upgraded to the newer v3
style for this to work, or is this being caused by something else?

Relevant reference(?):

<https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-V2Compatibility>.

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum