Namespace does not seem to include FilterElement

[Nate Klingenstein]

Trevor,

Try adding dc: to your FilterTemplate, and I think you need the LDAPProperty setting to be at the end of the main DataConnector element’s child elements.  I don’t know what the schema’s precise requirements are for the ordering of elements, but that’s what it’s choking on.

Hope this helps,
Nate.

On Mar 29, 2016, at 14:30, Trevor Robinson <tprobinson93 at gmail.com<mailto:tprobinson93 at gmail.com>> wrote:

Hello,

Thanks for your reply, unfortunately that didn't seem to help. I tried <dc:FilterTemplate> and <FilterTemplate>, with the removal of the xmlns and changing the type to dc:LDAPDirectory. Here's the log and the DataConnector.

net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 153 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 153; columnNumber: 28; cvc-complex-type.2.4.a: Invalid content was found starting with element 'dc:FilterTemplate'. One of '{"urn:mace:shibboleth:2.0:resolver:dc":LDAPProperty, "urn:mace:shibboleth:2.0:resolver:dc":StartTLSTrustCredential, "urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential, "urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool, "urn:mace:shibboleth:2.0:resolver:dc":Column, "urn:mace:shibboleth:2.0:resolver:dc":ResultCache, "urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is expected.


<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
    <dc:LDAPProperty name="java.naming.referral" value="follow"/>

        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>
        <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
        <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked" xmlns:security="urn:mace:shibboleth:2.0:security">
            <security:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</security:Certificate>
        </dc:StartTLSTrustCredential>
        <dc:ResultCache elementTimeToLive="PT1H" />
    </resolver:DataConnector>


On Tue, Mar 29, 2016 at 12:38 PM, Nate Klingenstein <nate.klingenstein at utah.edu<mailto:nate.klingenstein at utah.edu>> wrote:
Trevor,

It looks to me like you’ve set the default namespace on your resolver:DataConnector element to xmlns="urn:mace:shibboleth:2.0:resolver:dc”.  I would try removing that.  You may need to add the dc: namespace to your xsi:type.

Thanks,
Nate.

> On Mar 29, 2016, at 13:30, Trevor Robinson <tprobinson93 at gmail.com<mailto:tprobinson93 at gmail.com>> wrote:
>
> Hello,
>
> I've been trying to set up Shibboleth for the first time, and I'm hitting a strange problem. In attribute-resolver.xml, I'm trying to define a <FilterTemplate> for my LDAPDirectory, but Shibboleth bails on parsing the file saying that it doesn't know what a FilterTemplate element is, as if the namespace is wrong. I've tried the example from the wiki, and examples from other places, with the xmlns and without, and with the element dc: prefix and without. It also treats ReturnAttributes in the same way.
>
> Here's a pastebin of my attribute-resolver.xml: http://pastebin.com/ZZbeCbjf
> Here's a pastebin of the errors: http://pastebin.com/jp0et3VY
>
> Thanks,
>
> Trevor Robinson--
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160329/3d8bd37a/attachment-0001.html>