Shibboleth IDP 3 and Onelogin PHP SAML library

[Klingenstein, Nate]

This one jumps out at me:


7-06-21 19:03:30,577 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeFilterService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 59 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber: 90; cvc-complex-type.2.4.a: Invalid content was found starting with element 'PolicyRequirementRule'. One of '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule, "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 59 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber: 90; cvc-complex-type.2.4.a: Invalid content was found starting with element 'PolicyRequirementRule'. One of '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule, "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'PolicyRequirementRule'. One of '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule, "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Richard Genthner <richard at guthnur.net>
Sent: Wednesday, June 21, 2017 12:06:45 PM
To: Shib Users
Subject: Re: Shibboleth IDP 3 and Onelogin PHP SAML library

I'm not seeing anything jumping out to me in the idp-process log. https://gist.github.com/moos3/8fd87c678c06a53820aa3385e3be1584

On Wed, Jun 21, 2017 at 2:56 PM Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
On 6/21/17, 2:39 PM, "users on behalf of Richard Genthner" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of richard at guthnur.net<mailto:richard at guthnur.net>> wrote:


> I did some digging around and tried adding this to the saml-nameid.xml file

That *is* how to do it, the filter rule is either irrelevant if you choose to source the NameID via an unfiltered "mail" attribute, or just requires that you release the attribute, which you did.

> but doesn't seem to fix the issue. Thoughts ????

I can only tell you how to do it, which you found, and that you absolutely without question shouldn't do it. The rest is log analysis.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/ac544bc1/attachment.html>