Migrating to Relying-Party V3

[Cantor, Scott]

> Now I see the docs.
> 
> "As an upgraded V2 IdP will not have credentials suitable for decrypting
> content sent to the IdP, for now just edit conf/credentials.xml to comment
> out the encryption credential, as follows:"
> 
> That doesn't sound right to me given how the wiring works, so that's
> probably my error. I'd have to review it, I'm in another head space at the
> moment. Please file a bug.

I glanced closer, and I think it's a misunderstanding. The docs say to comment this out:

        <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
            p:privateKeyResource="%{idp.encryption.key}"
            p:certificateResource="%{idp.encryption.cert}"
            p:entityId-ref="entityID" />

I believe the OP probably commented out this:

    <util:list id="shibboleth.DefaultEncryptionCredentials">
...

</util:list>

The former is inside the latter.

You can't do that. Comment what it says to comment and it should work. The upgraded system doesn't have a decryption key, but you can't comment out the list of keys, just the specific key itself. That keeps the wiring happy.

-- Scott