alternate attributeSourceIDs for a given nameid format

[Baron Fujimoto]

I was able to script an attribute, attrEmail_aberrant, suitable for this
SP, but ran into an XML parsing error trying to use it via an activation
condition in saml-nameid.xml with the following entry:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                p:attributeSourceIds="#{ {'attrEmail_aberrant'} }"
            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="SP_entityID_aberrant" />
            </property>
        </bean>

Error when I reload:

ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:231]
- Service 'shibboleth.NameIdentifierGenerationService': Reload for
shibboleth.NameIdentifierGenerationService failed
net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
64 in XML document from file [/home/shib/idp/conf/saml-nameid.xml] is
invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 64;
columnNumber: 13; Element type "bean" must be followed by either attribute
specifications, ">" or "/>".

On Wed, Mar 10, 2021 at 9:06 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/10/21, 1:03 PM, "users on behalf of Baron Fujimoto" <
> users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:
>
> >    I'm afraid my grasp of IdP-initiated SPs is poor and I don't yet have
> an inkling how we might begin to
> > implement these possibilities without more explicit documentation or
> examples.
>
> That's the benefit of membership, to be brutally frank.
>
> >    Getting back to the original suggestion by Gary Lipscomb, may we can
> kludge that after all, assuming we can
> > have multiple SAML2AttributeSourcedGenerator beans in saml-nameid.xml
> that use result in the same nameid
> > format, but use different attributeSourceID. If so, would these beans be
> order dependent on a first match basis
> > (like metadata?). Ie. something like this?
>
> Yes, that is probably the best fix for this issue, just release the
> unusual source attribute to just that SP and then it won't ever run
> successfully for any other, generators just fall through if they have
> nothing to operate on.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210311/4c4cc8be/attachment.htm>