Shibboleth IDP 3 and Onelogin PHP SAML library

[Richard Genthner]

So I have updated my attribute-filters.xml file for idp 3 syntax

<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
        xmlns="urn:mace:shibboleth:2.0:afp"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp
http://shibboleth.net/schema/idp/shibboleth-afp.xsd">

    <!-- Release some attributes to an SP. -->
    <AttributeFilterPolicy id="onelogin-php-saml">
        <PolicyRequirementRule xsi:type="Requester" value="
https://saml.example.com/682879" />

        <AttributeRule attributeID="eduPersonPrincipalName">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="ANY" /><?xml version="1.0"
encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <!-- ========================= SAML NameID Generation
========================= -->

    <!--
    These generator lists handle NameID/Nameidentifier generation going
forward. By default,
    transient IDs for both SAML versions are enabled. The commented
examples are for persistent IDs
    and generating more one-off formats based on resolved attributes. The
suggested approach is to
    control their use via release of the underlying source attribute in the
filter policy rather
    than here, but you can set a property on any generator called
"activationCondition" to limit
    use in the most generic way.

    Most of the relevant configuration settings are controlled using
properties; an exception is
    the generation of arbitrary/custom formats based on attribute
information, examples of which
    are shown below.

    -->

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <!-- Uncommenting this bean requires configuration in
saml-nameid.properties. -->
        <!--
        <ref bean="shibboleth.SAML2PersistentGenerator" />
        -->

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
   p:omitQualifiers="true"
   p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
   p:attributeSourceIds="#{ {'mail'} }">

   <property name="activationCondition">
       <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="
https://saml.example.com/682879" />
   </property>
</bean>

    </util:list>

    <!-- SAML 1 NameIdentifier Generation -->
    <util:list id="shibboleth.SAML1NameIdentifierGenerators">

        <ref bean="shibboleth.SAML1TransientGenerator" />

        <bean parent="shibboleth.SAML1AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

    </util:list>

</beans>
        </AttributeRule>

        <AttributeRule attributeID="firstName">
          <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="lastName">
          <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

    </AttributeFilterPolicy>

</AttributeFilterPolicyGroup>


here is the latest log
https://gist.github.com/moos3/65795e5ae3538c8feef9c5780f077be7 I dont get
why its invalid now. My saml-nameid.xml is as follows:





On Wed, Jun 21, 2017 at 3:38 PM Richard Genthner <richard at guthnur.net>
wrote:

> Ok I haven't touched shib idp since 2.5.x, so that might be my issue here.
> I'll redo my configuration files and see if that fixes it.
>
> On Wed, Jun 21, 2017 at 3:24 PM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 6/21/17, 3:15 PM, "users on behalf of Richard Genthner" <
>> users-bounces at shibboleth.net on behalf of richard at guthnur.net> wrote:
>>
>> > according to the doc's I believe this should work:
>>
>> You're mixing namespace styles and syntaxes here, but offhand I would say
>> that you don't have a default namespace declared and therefore "Requester"
>> is an unqualified QName that isn't the same as afp:Requester. I don't know
>> what version you're using or which language variant you're trying to use,
>> but mixing the old stuff with split namespaces (afp, basic, saml prefixes)
>> with the newer flattened version is not a great choice.
>>
>> Basically, set xmlns="..." to what afp is bound to, get rid of all
>> references to basic and afp prefixes and then fix any bugs. It's a largely
>> mechanical translation to get off the old syntax and then it will be done.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/77fc83d4/attachment.html>