v3.2.1 Persistent NameID generator throws an error

[Mark McCoy]

I'm in the home stretch on our IdP 2 -> 3 upgrade, and I'm trying to enable the persistentId NameID. Need a little help on tracking down a bug. I've searched the Jira tracker and the mailing list but haven't found anything like this.

I uncommented the line in saml-nameid.xml and added the attribute and salt to the saml-nameid.properties file. Reloading the NameIdentifierGeneratorService gives me this error:
org.springframework.beans.MethodInvocationException: Property 'salt' threw exception;
nested exception is net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Salt cannot be null or empty

Here is the sanitized properties file. I clearly have a string in the salt property:
# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute = uid
idp.persistentId.useUnfilteredAttributes = true
# Do *NOT* share the salt with other people, it's like divulging your private key.
idp.persistentId.algorithm = SHA
idp.persistentId.salt = *********************

saml-nameid.xml:
    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
        <ref bean="shibboleth.SAML2PersistentGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

    </util:list>

Any thoughts? I can go back to the V2 way (creating an eduPersonTargetedID from a computedID data connector in attribute-resolver.xml and using that in a SourcedGenerator like the email address NameID) but I'd rather stick with the V3 methodology going forward.

Thanks,
Mark

Mark McCoy
OIT Manager - Platform Application Services
Office of Information Technology
The University of Texas at San Antonio
210-458-5871

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160718/58f3e973/attachment.html>