ScriptedAttribute Definition results in Error: "Invalid content was found starting with element 'InputDataConnector'"

[Daudt, Carl]

I am attempting to convert and migrate a working attribute-resolver.xml attribute definition of type xsi:type="Script" from my IdP v3.2 environment to my new IdP v3.3.3 server, converting it to xsi:type="scriptedAttribute".  I am receiving the following error in idp-process.log:

2018-10-18 11:37:32,227 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 180 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 180; columnNumber: 84; cvc-complex-type.2.4.a: Invalid content was found starting with element 'InputDataConnector'. One of '{"urn:mace:shibboleth:2.0:resolver":Dependency, "urn:mace:shibboleth:2.0:resolver":DisplayName, "urn:mace:shibboleth:2.0:resolver":DisplayDescription, "urn:mace:shibboleth:2.0:resolver":AttributeEncoder, "urn:mace:shibboleth:2.0:resolver":Script, "urn:mace:shibboleth:2.0:resolver":ScriptFile}' is expected.

However, my AttributeDefinition is set up similarly to the last example in the documentation (https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition).  Here is my AttributesDefinition in attributes-resolver.xml

---BEGIN ScriptedAttribute ATTRIBUTE DEFINITION ON MY IdP v3.3.3 SERVER---
    <AttributeDefinition id="securityGroup" xsi:type="ScriptedAttribute">
        <InputDataConnector ref="myLDAP" attributeNames="securityGroup memberOf" />

        <Script><![CDATA[
           (long script omitted)
        ]]></Script>

        <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonAffiliation" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonAffiliation" encodeType="false" />

    </AttributeDefinition>
---END ---

Is there is a problem with the wiki example that I mentioned above?  Why is the element 'InputDataConnector' resulting in an "Invalid content" error?

FYI, my working AttributeDefinition from my v3.2 environment is as follows:

---BEGIN Script ATTRIBUTE DEFINITION ON MY IdP v3.2 SERVER---
<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              id="securityGroup"
                              sourceAttributeID="eduPersonAffiliation">
    <resolver:Dependency ref="myLDAP" />
    <resolver:Dependency ref="forScriptWiJava18" />
    <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
    <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                               friendlyName="eduPersonAffiliation" />

    <Script><![CDATA[
           (long script omitted)
    ]]></Script>
</resolver:AttributeDefinition>
---END ---


Carl R. Daudt
Enterprise Applications Systems Analyst, Information Technology
Taylor University


The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.