Error Using 'EntityAttributeExactMatch' Filter for Global R&S

[Andrew Morgan]

On Fri, 18 Mar 2016, Rising, Matt wrote:

> I am setting up a new IdPv3.2.1 system to support InCommon global R&S 
> using this entity attribute matching rule:
>
> <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
>    attributeName="http://macedir.org/entity-category"
>    attributeValue="http://refeds.org/category/research-and-scholarship"/>
>                                <AttributeRule attributeID=" ...
>
> However, whenever I test the rule with aacli.bat with an entity ID that 
> should match the rule I receive the following warning in the idp logs:
>
> WARN 
> [net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterEntityAttributeExactPolicyRule:75] 
> - Attribute Filter 
> '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/PolicyRequirementRule:_a8ca67b2900c2ac9c931336eb77ea2ba': 
> Could not locate SP metadata context
>
> And no attributes are released.  I suspect that the rule match is 
> working because I only see this warning when testing with an entity ID 
> in the InCommon metadata that has the 'http://refeds.org...' attribute, 
> but don't understand why I am receiving the metadata error.  Example 
> entity ID:  "https://dmp.cdlib.org"
>
> The warning is really similar to 
> https://issues.shibboleth.net/jira/browse/IDP-762 but on a different 
> filter type, so I'm unsure if I am doing something wrong or hitting a 
> bug.
>
> The rule published by InCommon uses the 'saml' namespace in the rule 
> type "saml: EntityAttributeExactMatch" but the SAML schema 
> (urn:mace:shibboleth:2.0:afp:mf:saml?) isn't included in the default 
> AttributeFilterPolicyGroup tag in IdPv3's attribute-filter.xml file. 
> There IS a reference to EntityAttributeExactMatch in the included schema 
> (urn:mace:shibboleth:2.0:afp 
> http://shibboleth.net/schema/idp/shibboleth-afp.xsd):
>
> <!--  The old 'SAML' schema  -->
> <complexType name="EntityAttributeExactMatch">
> <annotation>
> ...
>
> Do I need to include the 'saml' schema or can I just remove the 'saml:' 
> reference from the type value?  I am not getting any errors indicating 
> that Shibboleth doesn't know what 'EntityAttributeExactMatch' is so I 
> suspect that the 'saml:' reference isn't necessary, but don't know for 
> sure.

We are running IDP v3.2.0 with the following attribute filter:

     <!-- Release Research and Scholarship attribute bundle for all employees, associates, and students -->
     <AttributeFilterPolicy id="releaseEmployeeFullBundleToRnS">
         <PolicyRequirementRule xsi:type="AND">
             <Rule xsi:type="OR">
                 <Rule xsi:type="Value" attributeID="eduPersonPrimaryAffiliation" value="employee" />
                 <Rule xsi:type="Value" attributeID="eduPersonPrimaryAffiliation" value="affiliate" />
                 <Rule xsi:type="Value" attributeID="eduPersonPrimaryAffiliation" value="student" />
             </Rule>
             <Rule xsi:type="EntityAttributeExactMatch"
                    attributeName="http://macedir.org/entity-category"
                   attributeValue="http://refeds.org/category/research-and-scholarship"/>
         </PolicyRequirementRule>

I don't see any warnings in idp-process.log when I use aacli to retrieve 
the attributes from https://dmp.cdlib.org.

 	Andy