delegation in IDP3

[Robert A Basch]

> On Jun 8, 2016, at 12:09 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> Is there any documentation of how to configure delegation in IDP and SP?
> 
> There has been SP documentation on ECP and the generally unused policy controls around delegation for a long time. There is no IdP documentation. I don't know when, if ever, it will get done, it would be up to Brent.
> 
> Since there is no real client support for any of that work, it's not a feature anybody uses, and we understand that.

We have some SPs using delegation, against our v2 IdP with the delegation
extension, and I was coincidentally just about to post here about a
problem encountered in trying to update our configuration for v3.

In our v3 test environment, I am trying to modify relying-party.xml
(legacy configuration) to match what we did for v2, using pointers Brent
provided in an email from several months ago:

  http://marc.info/?l=shibboleth-users&m=144797115827565&w=2

I have made progress (I think) in updating the relevant SAML2SSOProfile
configurations, but adding a SAML2SSOSProfile configuration to a delegate's
<RelyingParty> config resulted in this error locating the bean definition
parser (lines wrapped for readability):

net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.BeanDefinitionStoreException:
 Unexpected exception parsing XML document from file
 [/usr/local/shibboleth-idp/conf/relying-party.xml]; nested exception is
 java.lang.IllegalArgumentException:
 Can not locate BeanDefinitionParser for element:
 {urn:mace:shibboleth:2.0:relying-party}ProfileConfiguration, carrying
    xsi:type: {urn:mace:shibboleth:2.0:relying-party:saml}SAML2SSOSProfile
  at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)

The offending element currently looks like:

    <ProfileConfiguration xsi:type="saml:SAML2SSOSProfile"                                                                    
        maximumTokenDelegationChainLength="1"
        allowDelegation="true"
        delegationPredicateRef="testDelegationPredicate"
        signAssertions="always"
        encryptNameIds="never" />                                                                                         

Is there something I am missing that can get past this error?

We will need to have delegation working in v3 before we can upgrade.

Thanks,
Bob