Shibboleth IDP 3 and Onelogin PHP SAML library

[Richard Genthner]

according to the doc's I believe this should work:

    <afp:AttributeFilterPolicy id="wheniwork">
        <afp:PolicyRequirementRule xsi:type="Requester" value="
https://saml.example.com/682879" />
        <afp:AttributeRule attributeID="firstName">
                <PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="lastName">
                <PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="mail">
                <PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonPrincipalName">
                <PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
     </afp:AttributeFilterPolicy>

it would seem its doesn't like PolicyRequirementRule's xsi:type of
Requester.



On Wed, Jun 21, 2017 at 3:08 PM Klingenstein, Nate <
nklingenstein at calstate.edu> wrote:

> This one jumps out at me:
>
>
> 7-06-21 19:03:30,577 - ERROR
> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181]
> - Service 'shibboleth.AttributeFilterService': Initial load failed
> net.shibboleth.utilities.java.support.service.ServiceException:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 59 in XML document from file
> [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber:
> 90; cvc-complex-type.2.4.a: Invalid content was found starting with element
> 'PolicyRequirementRule'. One of
> '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule,
> "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
> at
> net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)
> Caused by:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 59 in XML document from file
> [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber:
> 90; cvc-complex-type.2.4.a: Invalid content was found starting with element
> 'PolicyRequirementRule'. One of
> '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule,
> "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
> at
> org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
> Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid
> content was found starting with element 'PolicyRequirementRule'. One of
> '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule,
> "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
> at
> com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)
>
> ------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of Richard
> Genthner <richard at guthnur.net>
> *Sent:* Wednesday, June 21, 2017 12:06:45 PM
> *To:* Shib Users
> *Subject:* Re: Shibboleth IDP 3 and Onelogin PHP SAML library
>
> I'm not seeing anything jumping out to me in the idp-process log.
> https://gist.github.com/moos3/8fd87c678c06a53820aa3385e3be1584
>
> On Wed, Jun 21, 2017 at 2:56 PM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 6/21/17, 2:39 PM, "users on behalf of Richard Genthner" <
>> users-bounces at shibboleth.net on behalf of richard at guthnur.net> wrote:
>>
>>
>> > I did some digging around and tried adding this to the saml-nameid.xml
>> file
>>
>> That *is* how to do it, the filter rule is either irrelevant if you
>> choose to source the NameID via an unfiltered "mail" attribute, or just
>> requires that you release the attribute, which you did.
>>
>> > but doesn't seem to fix the issue. Thoughts ????
>>
>> I can only tell you how to do it, which you found, and that you
>> absolutely without question shouldn't do it. The rest is log analysis.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/eaae7859/attachment.html>