alternate attributeSourceIDs for a given nameid format

[Baron Fujimoto]

Mahalo to Phil Pishioneri who spotted the problem and suggested the
solution to me: missing ">" at the end of the p:attributeSourceIds line,
which yields the working entry:

       <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                p:attributeSourceIds="#{ {'attrEmail_aberrant'} }" >
            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="SP_entityID_aberrant" />
            </property>
        </bean>

Since I only expect to use this exception and custom attrEmail_aberrant
attribute for this particular SP, I think
the c:candidate="SP_entityID_aberrant" is probably fine. This form is
provided as an example for a single SP here:
<
https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-SpecificRelyingParties
>.
If this were applicable to multiple SPs, you're right I'd want the plural
candidates form.

On Thu, Mar 11, 2021 at 8:01 AM IAM David Bantz <dabantz at alaska.edu> wrote:

> maybe...
>
>  c:candidate*s*="#{ {‘SP_entityID_aberrant' } }” ...
>
> On 11Mar, 2021 at 08:42:04, Baron Fujimoto <baron at hawaii.edu> wrote:
>
>> I was able to script an attribute, attrEmail_aberrant, suitable for this
>> SP, but ran into an XML parsing error trying to use it via an activation
>> condition in saml-nameid.xml with the following entry:
>>
>>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>>
>> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>>                 p:attributeSourceIds="#{ {'attrEmail_aberrant'} }"
>>             <property name="activationCondition">
>>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
>> c:candidate="SP_entityID_aberrant" />
>>             </property>
>>         </bean>
>>
>> Error when I reload:
>>
>> ERROR
>> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231]
>> - Service 'shibboleth.NameIdentifierGenerationService': Reload for
>> shibboleth.NameIdentifierGenerationService failed
>> net.shibboleth.utilities.java.support.service.ServiceException:
>> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
>> 64 in XML document from file [/home/shib/idp/conf/saml-nameid.xml] is
>> invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 64;
>> columnNumber: 13; Element type "bean" must be followed by either attribute
>> specifications, ">" or "/>".
>>
>> On Wed, Mar 10, 2021 at 9:06 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>>> On 3/10/21, 1:03 PM, "users on behalf of Baron Fujimoto" <
>>> users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:
>>>
>>> >    I'm afraid my grasp of IdP-initiated SPs is poor and I don't yet
>>> have an inkling how we might begin to
>>> > implement these possibilities without more explicit documentation or
>>> examples.
>>>
>>> That's the benefit of membership, to be brutally frank.
>>>
>>> >    Getting back to the original suggestion by Gary Lipscomb, may we
>>> can kludge that after all, assuming we can
>>> > have multiple SAML2AttributeSourcedGenerator beans in saml-nameid.xml
>>> that use result in the same nameid
>>> > format, but use different attributeSourceID. If so, would these beans
>>> be order dependent on a first match basis
>>> > (like metadata?). Ie. something like this?
>>>
>>> Yes, that is probably the best fix for this issue, just release the
>>> unusual source attribute to just that SP and then it won't ever run
>>> successfully for any other, generators just fall through if they have
>>> nothing to operate on.
>>>
>>> -- Scott
>>>
>>>
>>> --
>>> For Consortium Member technical support, see
>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>> --
>> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210311/423e7c8c/attachment.htm>