relying-party selection process

[Michael Dahlberg]

I have the following relying-party.xml

    -->
    <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
            <!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> -->
            </list>
        </property>
    </bean>

    <!--
    Default configuration, with default settings applied for all profiles,
and enables
    the attribute-release consent flow.
    -->
    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <bean parent="Shibboleth.SSO"
p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <!--
    Unverified RP configuration, defaults to no support for any profiles.
Add <ref> elements to the list
    to enable specific default profile settings (as below), or create new
beans inline to override defaults.

    "Unverified" typically means the IdP has no metadata, or equivalent way
of assuring the identity and
    legitimacy of a requesting system. To run an "open" IdP, you can enable
profiles here.
    -->
    <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
            <!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> -->
            </list>
        </property>
    </bean>

    <!--
    Default configuration, with default settings applied for all profiles,
and enables
    the attribute-release consent flow.
    -->
    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <bean parent="Shibboleth.SSO"
p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <ref bean="Liberty.SSOS" />
            </list>
        </property>
    </bean>

    <bean id="r01" parent="RelyingPartyByName"
          c:relyingPartyIds="#{{'concursolutions.com',
                                'cornerstone'}}">
        <property name="profileConfigurations">
          <list>
             <bean id="b01" parent="Shibboleth.SSO"
                 p:signAssertions="false"
                 p:includeAttributeStatement="true" />
          </list>
        </property>
     </bean>

     <bean id="r02" parent="RelyingPartyByName"
           c:relyingPartyIds="#{{'https://admin.dc4.pageuppeople.com'}}">
        <property name="profileConfigurations">
          <list>
             <bean id="b02" parent="SAML2.SSO"
                 p:encryptAssertions="false"
                 p:encryptNameIDs="false"
                 p:signAssertions="true"
                 p:signResponses="true" />
          </list>
        </property>
     </bean>

     <bean id="r03" parent="RelyingPartyByName"
           c:relyingPartyIds="#{{'bucknell.maps.arcgis.com'}}">
        <property name="profileConfigurations">
          <list>
             <bean id="b03" parent="SAML2.SSO"
                 p:postAuthenticationFlows="context-check"
                 p:encryptAssertions="false"
                 p:includeAttributeStatement="false"
                 p:signAssertions="false"
                 p:encryptNameIDs="false"

 p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified'}}"
/>
          </list>
        </property>
     </bean>

    <!-- Container for any overrides you want to add. -->

    <util:list id="shibboleth.RelyingPartyOverrides">

        <!--
        Override example that identifies a single RP by name and configures
it
        for SAML 2 SSO without encryption. This is a common "vendor"
scenario.
        -->
        <!--
        <bean parent="RelyingPartyByName" c:relyingPartyIds="
https://sp.example.org">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>
        -->

    </util:list>



When I go to the site http://bucknell.maps.arcgis.com the log file states:

2016-03-08 16:14:46,686 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132]
- Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching
RelyingPartyContext based on SAML peer bucknell.maps.arcgis.com
2016-03-08 16:14:46,689 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293]
- Resolving relying party configuration
2016-03-08 16:14:46,689 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:314]
- No relying party configurations are applicable, returning the default
configuration shibboleth.DefaultRelyingParty
2016-03-08 16:14:46,689 - DEBUG
[net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] -
Profile Action SelectRelyingPartyConfiguration: Found relying party
configuration shibboleth.DefaultRelyingParty for request

Why would bean 'r03' not be selected?
Is there an ancillary file that needs to be modified in order to enable the
selection process?
Is there some other item that I should be looking for in the logs to
determine why that bean was not selected?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160308/f5b20327/attachment.html>