ScriptedAttribute Definition results in Error: "Invalid content was found starting with element 'InputDataConnector'"

[Losen, Stephen C (scl)]

Hi Carl,

I believe the XML element "InputDataConnector" is not supported until Shib IDP 3.4 and you say you are running 3.3.3. 

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daudt, Carl
Sent: Thursday, October 18, 2018 2:26 PM
To: users at shibboleth.net
Subject: ScriptedAttribute Definition results in Error: "Invalid content was found starting with element 'InputDataConnector'"

I am attempting to convert and migrate a working attribute-resolver.xml attribute definition of type xsi:type="Script" from my IdP v3.2 environment to my new IdP v3.3.3 server, converting it to xsi:type="scriptedAttribute".  I am receiving the following error in idp-process.log:

2018-10-18 11:37:32,227 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 180 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 180; columnNumber: 84; cvc-complex-type.2.4.a: Invalid content was found starting with element 'InputDataConnector'. One of '{"urn:mace:shibboleth:2.0:resolver":Dependency, "urn:mace:shibboleth:2.0:resolver":DisplayName, "urn:mace:shibboleth:2.0:resolver":DisplayDescription, "urn:mace:shibboleth:2.0:resolver":AttributeEncoder, "urn:mace:shibboleth:2.0:resolver":Script, "urn:mace:shibboleth:2.0:resolver":ScriptFile}' is expected.

However, my AttributeDefinition is set up similarly to the last example in the documentation (https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition).  Here is my AttributesDefinition in attributes-resolver.xml

---BEGIN ScriptedAttribute ATTRIBUTE DEFINITION ON MY IdP v3.3.3 SERVER---
    <AttributeDefinition id="securityGroup" xsi:type="ScriptedAttribute">
        <InputDataConnector ref="myLDAP" attributeNames="securityGroup memberOf" />

        <Script><![CDATA[
           (long script omitted)
        ]]></Script>

        <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonAffiliation" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonAffiliation" encodeType="false" />

    </AttributeDefinition>
---END ---

Is there is a problem with the wiki example that I mentioned above?  Why is the element 'InputDataConnector' resulting in an "Invalid content" error?

FYI, my working AttributeDefinition from my v3.2 environment is as follows:

---BEGIN Script ATTRIBUTE DEFINITION ON MY IdP v3.2 SERVER---
<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              id="securityGroup"
                              sourceAttributeID="eduPersonAffiliation">
    <resolver:Dependency ref="myLDAP" />
    <resolver:Dependency ref="forScriptWiJava18" />
    <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
    <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                               friendlyName="eduPersonAffiliation" />

    <Script><![CDATA[
           (long script omitted)
    ]]></Script>
</resolver:AttributeDefinition>
---END ---


Carl R. Daudt
Enterprise Applications Systems Analyst, Information Technology
Taylor University


The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net