PolicyRequirementRule 3.x vs. 2.x

[Dave Bartholomew]

I have a Shib 3.2.1 (new style) PolicyRequirementRule that works:



<PolicyRequirementRule xsi:type="AND">

   <Rule xsi:type="OR">

        <Rule xsi:type="Requester" value="<prodSPentityID>" />

        <Rule xsi:type="Requester" value="<testSPentityID>" />

   </Rule>

   <Rule xsi:type="OR">

       <Rule xsi:type="Value" value="current" attributeID="currentStudent"/>

       <Rule xsi:type="Value" value="Staff"
attributeID="eduPersonPrimaryAffiliation"/>

       <Rule xsi:type="Value" value="Faculty"
attributeID="eduPersonPrimaryAffiliation"/>

   </Rule>

</PolicyRequirementRule>



And a similar one in 2.x that doesn't work:



<PolicyRequirementRule xsi:type="basic:AND">

   <Rule xsi:type="basic:OR">

        <Rule xsi:type="basic:AttributeRequesterString"
value="<prodSPentityID>" />

        <Rule xsi:type="basic:AttributeRequesterString"
value="<testSPentityID>" />

   </Rule>

   <Rule xsi:type="basic:OR">

       <Rule xsi:type="basic:AttributeValueString" value="current"
attributeID="currentStudent"/>

       <Rule xsi:type="basic:AttributeValueString" value="Staff"
attributeID="eduPersonPrimaryAffiliation"/>

       <Rule xsi:type="basic:AttributeValueString" value="Faculty"
attributeID="eduPersonPrimaryAffiliation"/>

   </Rule>

</PolicyRequirementRule>



idp-process says:



Invalid content was found starting with element 'Rule'. One of
'{"urn:mace:shibboleth:2.0:afp:mf:basic":Rule,
"urn:mace:shibboleth:2.0:afp:mf:basic":RuleReference}' is expected.



I've looked at the corresponding schema files (which I've left at the
installation defaults) but nothing is popping out as the obvious answer as
to what's illegal about my 2.x configuration.



Any enlightenment would be appreciated.



--Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160302/f89db7ab/attachment.html>