Migrating to Relying-Party V3

[Roger Dills]

Hello,

Yes, the inclusion of the "util" line in the commenting was what caused all the complaints. As none of the decryption stanza is currently used, I guess even empty keys need mention.

Thank you for your help. 
 
-Roger

---------------------------------------------------------------------------------------------------------------------------
Date: Tue, 25 Apr 2017 16:58:08 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: Migrating to Relying-Party V3
Message-ID:
	<9846A6064BD102419D06814DD0D78DE11C01E3A4 at CIO-TNC-D2MBX02.osuad.osu.edu>
	
Content-Type: text/plain; charset="us-ascii"

> Now I see the docs.
> 
> "As an upgraded V2 IdP will not have credentials suitable for 
> decrypting content sent to the IdP, for now just edit 
> conf/credentials.xml to comment out the encryption credential, as follows:"
> 
> That doesn't sound right to me given how the wiring works, so that's 
> probably my error. I'd have to review it, I'm in another head space at 
> the moment. Please file a bug.

I glanced closer, and I think it's a misunderstanding. The docs say to comment this out:

        <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
            p:privateKeyResource="%{idp.encryption.key}"
            p:certificateResource="%{idp.encryption.cert}"
            p:entityId-ref="entityID" />

I believe the OP probably commented out this:

    <util:list id="shibboleth.DefaultEncryptionCredentials">
...

</util:list>

The former is inside the latter.

You can't do that. Comment what it says to comment and it should work. The upgraded system doesn't have a decryption key, but you can't comment out the list of keys, just the specific key itself. That keeps the wiring happy.

-- Scott