Shibboleth IDP 3 and Onelogin PHP SAML library

[Richard Genthner]

3.3.1

On Wed, Jun 21, 2017 at 3:19 PM Klingenstein, Nate <
nklingenstein at calstate.edu> wrote:

> Which version of the IdP are you running?  Requester was only added in 3.3
> AFAIK, not 3.2 as mentioned on this page.  Try
> basic:AttributeRequesterString instead.
>
>
> https://wiki.shibboleth.net/confluence/display/IDP30/RequesterConfiguration
> ------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of Richard
> Genthner <richard at guthnur.net>
> *Sent:* Wednesday, June 21, 2017 12:15:47 PM
>
> *To:* Shib Users
> *Subject:* Re: Shibboleth IDP 3 and Onelogin PHP SAML library
> according to the doc's I believe this should work:
>
>     <afp:AttributeFilterPolicy id="wheniwork">
>         <afp:PolicyRequirementRule xsi:type="Requester" value="
> https://saml.example.com/682879" />
>         <afp:AttributeRule attributeID="firstName">
>                 <PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>         <afp:AttributeRule attributeID="lastName">
>                 <PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>         <afp:AttributeRule attributeID="mail">
>                 <PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>         <afp:AttributeRule attributeID="eduPersonPrincipalName">
>                 <PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>      </afp:AttributeFilterPolicy>
>
> it would seem its doesn't like PolicyRequirementRule's xsi:type of
> Requester.
>
>
>
> On Wed, Jun 21, 2017 at 3:08 PM Klingenstein, Nate <
> nklingenstein at calstate.edu> wrote:
>
>> This one jumps out at me:
>>
>>
>> 7-06-21 19:03:30,577 - ERROR
>> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181]
>> - Service 'shibboleth.AttributeFilterService': Initial load failed
>> net.shibboleth.utilities.java.support.service.ServiceException:
>> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
>> 59 in XML document from file
>> [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested
>> exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber:
>> 90; cvc-complex-type.2.4.a: Invalid content was found starting with element
>> 'PolicyRequirementRule'. One of
>> '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule,
>> "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
>> at
>> net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)
>> Caused by:
>> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
>> 59 in XML document from file
>> [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested
>> exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber:
>> 90; cvc-complex-type.2.4.a: Invalid content was found starting with element
>> 'PolicyRequirementRule'. One of
>> '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule,
>> "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
>> at
>> org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
>> Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid
>> content was found starting with element 'PolicyRequirementRule'. One of
>> '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule,
>> "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.
>> at
>> com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)
>>
>> ------------------------------
>> *From:* users <users-bounces at shibboleth.net> on behalf of Richard
>> Genthner <richard at guthnur.net>
>> *Sent:* Wednesday, June 21, 2017 12:06:45 PM
>> *To:* Shib Users
>> *Subject:* Re: Shibboleth IDP 3 and Onelogin PHP SAML library
>>
>> I'm not seeing anything jumping out to me in the idp-process log.
>> https://gist.github.com/moos3/8fd87c678c06a53820aa3385e3be1584
>>
>> On Wed, Jun 21, 2017 at 2:56 PM Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>>> On 6/21/17, 2:39 PM, "users on behalf of Richard Genthner" <
>>> users-bounces at shibboleth.net on behalf of richard at guthnur.net> wrote:
>>>
>>>
>>> > I did some digging around and tried adding this to the saml-nameid.xml
>>> file
>>>
>>> That *is* how to do it, the filter rule is either irrelevant if you
>>> choose to source the NameID via an unfiltered "mail" attribute, or just
>>> requires that you release the attribute, which you did.
>>>
>>> > but doesn't seem to fix the issue. Thoughts ????
>>>
>>> I can only tell you how to do it, which you found, and that you
>>> absolutely without question shouldn't do it. The rest is log analysis.
>>>
>>> -- Scott
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/480f822b/attachment-0001.html>