Adding principal connector to IdPv3

[Morris, Andi]

Hi Rod, thanks for replying again.

Full disclosure, I'm asking these questions for a third party engineer. They're trying to configure our v3 IdP to work with an appliance called Access Manager by federating the two services. The user hits Access Manager, which in turn talks to Shibboleth which performs the authentication and passes back to Access Manager (at least that's how I understand it).

The engineer doing the install is working from documentation for version 2, and there isn't any updated docs for Access Manager for version 3. This has been raised with the supplier.

I'll ask them to also take a look at this page to see if it points them in the right direction: https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop (It's not ADFS, but similar in nature I believe).

 > Are you sure?  Did it not maybe say:

> The prefix "pc" for element " pc:Transient " is not bound

I've just updated to check - config now looks like the following:

<AttributeResolver
        xmlns="urn:mace:shibboleth:2.0:resolver"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">

<!-- Principal Connectors -->
 <PrincipalConnector xsi:type="Transient" xmlns="urn:mace:shibboleth:2.0:resolver:pc" id="saml2Persistent"
        nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />

<!-- Name Identifier related attributes -->
 <AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />


The error now shows as:

2017-04-03 13:45:56,517 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 24 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 24; columnNumber: 79; cvc-complex-type.2.4.a: Invalid content was found starting with element 'PrincipalConnector'. One of '{"urn:mace:shibboleth:2.0:resolver":AttributeDefinition, "urn:mace:shibboleth:2.0:resolver":DataConnector, "urn:mace:shibboleth:2.0:resolver":PrincipalConnector}' is expected.
        at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 24 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 24; columnNumber: 79; cvc-complex-type.2.4.a: Invalid content was found starting with element 'PrincipalConnector'. One of '{"urn:mace:shibboleth:2.0:resolver":AttributeDefinition, "urn:mace:shibboleth:2.0:resolver":DataConnector, "urn:mace:shibboleth:2.0:resolver":PrincipalConnector}' is expected.
        at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'PrincipalConnector'. One of '{"urn:mace:shibboleth:2.0:resolver":AttributeDefinition, "urn:mace:shibboleth:2.0:resolver":DataConnector, "urn:mace:shibboleth:2.0:resolver":PrincipalConnector}' is expected.

Cheers,
Andi

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: 03 April 2017 13:10
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: Adding principal connector to IdPv3

> Thanks Rod. I've read that document several times and I'm none the wiser.

So,  you are not trying to " allow reversal of persistent IDs" that's what your original post seemed to indicate?  You'll need to be more explicit.


> Is this a schema thing?
Yes.

> It looks like it's failing on the resolver portion of
> resolver:PrincipalConnector, but removing it also doesn't fix the issue.

Are you sure?  Did it not maybe say:

> The prefix "pc" for element " pc:Transient " is not bound

But don't waste time getting end of life configuration working.  Use the C14N way.

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

[Cardiff Metropolitan University - Queens Anniversary Prizes 2015]<http://www.cardiffmet.ac.uk/news/Pages/Cardiff-Met-research-recognised-in-Queens-Anniversary-Prizes-for-Higher-and-Further-Education.aspx>