v2->v3 upgrade, properties files

[Baron Fujimoto]

I'm working on an IdP v2->v3 upgrade. I've taken the recommendation to
update existing configs rather than attempt to recreate them from scratch.
Right I'm at the point where I'm attempting to deal with errors encountered
when I try to start up the IdP, such as this one:

ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 583 in XML document from file [/home/shib/idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 583; columnNumber: 87; cvc-enumeration-valid: Value '%{idp.attribute.resolver.LDAP.connectionStrategy}' is not facet-valid with respect to enumeration '[DEFAULT, ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM]'. It must be a value from the enumeration.

This was carried over from or v2 config where we have:
===== attribute-resolver.xml =====

    <resolver:DataConnector xsi:type="dc:LDAPDirectory"
            id                  = "UH_LDAP"
            useStartTLS         = "${ldap.useStartTLS}"
            ldapURL             = "${ldap.url}"
            baseDN              = "${ldap.base}"
            principal           = "${ldap.principal}"
            principalCredential = "${ldap.credential}"
            connectionStrategy  = "${ldap.connection.strategy}">

        <dc:FilterTemplate>
                <![CDATA[
                    (uid=$requestContext.principalName)
                ]]>
        </dc:FilterTemplate>

        <dc:ReturnAttributes>
                uid
                uhuuid
                mail
                edupersonaffiliation
                sn
                givenName
                cn
                displayName
        </dc:ReturnAttributes>

        <dc:LDAPProperty name="java.naming.ldap.factory.socket" value="javax.net.ssl.SSLSocketFactory"/>

    </resolver:DataConnector>
=====

and we had factored put these properties with the following in

===== services.xml =====
    <srv:Service id="shibboleth.AttributeResolver"
                 xsi:type="attribute-resolver:ShibbolethAttributeResolver">
        <srv:ConfigurationResource xsi:type="resource:FilesystemResource"
                                   file="/home/shib/idp/conf/attribute-resolver.xml" >
            <resource:ResourceFilter xsi:type="resource:PropertyReplacement"
                            propertyFile="/home/shib/idp/conf/config.properties" />
        </srv:ConfigurationResource>
    </srv:Service>

(Though I think this may be in the context of watched resource/reloadable service?)
=====

However, in v3, it looks like these properties now reside in ldap.properties
with entries like:

===== ldap.properties =====
idp.attribute.resolver.LDAP.ldapURL             = %{idp.authn.LDAP.ldapURL}
idp.attribute.resolver.LDAP.baseDN              = %{idp.authn.LDAP.baseDN:undefined}
idp.attribute.resolver.LDAP.bindDN              = %{idp.authn.LDAP.bindDN:undefined}
idp.attribute.resolver.LDAP.bindDNCredential    = %{idp.authn.LDAP.bindDNCredential:undefined}
idp.attribute.resolver.LDAP.useStartTLS         = %{idp.authn.LDAP.useStartTLS:true}
idp.attribute.resolver.LDAP.trustCertificates   = %{idp.authn.LDAP.trustCertificates:undefined}
idp.attribute.resolver.LDAP.searchFilter        = (uid=$resolutionContext.principal)
idp.attribute.resolver.LDAP.returnAttributes    = cn,homephone,mail
=====

But the ldap.properties file doesn't seem to actually be referenced by
attribute-resolver.xml. I apologize if this is a dumb question, but how do
you do the equivalent of what was done in our v2 services.xml to get the
v3 attribute-resolver to read properties from ldap.properties?

The LDAPConnector page mentions the springResource or springResourceRef
attributes delegating the configuration is delegated to the supplied
resources, but if this the right track, I'm still not quite closing the
gap.  <https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector>
Is there more documentation or an example for this?

I'm also not finding a good reference on the use of "%" vs "$" for
interpolating the placeholder values. I've tried both $ and % in
attribute-resolvers.xml with the same results. The use of ":value"
also suggests conditional interpolation?

Any guidance would be appreciated.

Aloha,
-baron
-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum