Error Using 'EntityAttributeExactMatch' Filter for Global R&S

[Rising, Matt]

I am setting up a new IdPv3.2.1 system to support InCommon global R&S using this entity attribute matching rule:

<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
    attributeName="http://macedir.org/entity-category"<http://macedir.org/entity-category>
    attributeValue="http://refeds.org/category/research-and-scholarship"<http://refeds.org/category/research-and-scholarship>/>
                                <AttributeRule attributeID=" ...

However, whenever I test the rule with aacli.bat with an entity ID that should match the rule I receive the following warning in the idp logs:

WARN [net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterEntityAttributeExactPolicyRule:75] - Attribute Filter '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/PolicyRequirementRule:_a8ca67b2900c2ac9c931336eb77ea2ba': Could not locate SP metadata context

And no attributes are released.  I suspect that the rule match is working because I only see this warning when testing with an entity ID in the InCommon metadata that has the 'http://refeds.org...' attribute, but don't understand why I am receiving the metadata error.  Example entity ID:  "https://dmp.cdlib.org"

The warning is really similar to https://issues.shibboleth.net/jira/browse/IDP-762 but on a different filter type, so I'm unsure if I am doing something wrong or hitting a bug.

The rule published by InCommon uses the 'saml' namespace in the rule type "saml: EntityAttributeExactMatch" but the SAML schema (urn:mace:shibboleth:2.0:afp:mf:saml?) isn't included in the default AttributeFilterPolicyGroup tag in IdPv3's attribute-filter.xml file.  There IS a reference to EntityAttributeExactMatch in the included schema (urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd):

<!--  The old 'SAML' schema  -->
<complexType name="EntityAttributeExactMatch">
<annotation>
...

Do I need to include the 'saml' schema or can I just remove the 'saml:' reference from the type value?  I am not getting any errors indicating that Shibboleth doesn't know what 'EntityAttributeExactMatch' is so I suspect that the 'saml:' reference isn't necessary, but don't know for sure.

Matt Rising







-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160318/b2dc2659/attachment-0001.html>