alternate attributeSourceIDs for a given nameid format

[IAM David Bantz]

maybe...

 c:candidate*s*="#{ {‘SP_entityID_aberrant' } }” ...

On 11Mar, 2021 at 08:42:04, Baron Fujimoto <baron at hawaii.edu> wrote:

> I was able to script an attribute, attrEmail_aberrant, suitable for this
> SP, but ran into an XML parsing error trying to use it via an activation
> condition in saml-nameid.xml with the following entry:
>
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>                 p:attributeSourceIds="#{ {'attrEmail_aberrant'} }"
>             <property name="activationCondition">
>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidate="SP_entityID_aberrant" />
>             </property>
>         </bean>
>
> Error when I reload:
>
> ERROR
> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231]
> - Service 'shibboleth.NameIdentifierGenerationService': Reload for
> shibboleth.NameIdentifierGenerationService failed
> net.shibboleth.utilities.java.support.service.ServiceException:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 64 in XML document from file [/home/shib/idp/conf/saml-nameid.xml] is
> invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 64;
> columnNumber: 13; Element type "bean" must be followed by either attribute
> specifications, ">" or "/>".
>
> On Wed, Mar 10, 2021 at 9:06 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 3/10/21, 1:03 PM, "users on behalf of Baron Fujimoto" <
>> users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:
>>
>> >    I'm afraid my grasp of IdP-initiated SPs is poor and I don't yet
>> have an inkling how we might begin to
>> > implement these possibilities without more explicit documentation or
>> examples.
>>
>> That's the benefit of membership, to be brutally frank.
>>
>> >    Getting back to the original suggestion by Gary Lipscomb, may we can
>> kludge that after all, assuming we can
>> > have multiple SAML2AttributeSourcedGenerator beans in saml-nameid.xml
>> that use result in the same nameid
>> > format, but use different attributeSourceID. If so, would these beans
>> be order dependent on a first match basis
>> > (like metadata?). Ie. something like this?
>>
>> Yes, that is probably the best fix for this issue, just release the
>> unusual source attribute to just that SP and then it won't ever run
>> successfully for any other, generators just fall through if they have
>> nothing to operate on.
>>
>> -- Scott
>>
>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210311/171208af/attachment.htm>