MDDriven ECP profile activation

[Andrew Jason Morgan]

I'm attempting to use MDDriven configuration to activate the ECP profile for a specific SP, but I've done something wrong.  I used the example at https://wiki.shibboleth.net/confluence/display/IDP4/MetadataDrivenConfiguration under "Legacy Profiles > Enabling SAML 1.1 SSO conditionally using a tag" as a starting point.  I tried using this in relying-party.xml:

<bean parent="SAML2.ECP.MDDriven" p:postAuthenticationFlows="context-check">
  <property name="activationCondition">
    <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
      <constructor-arg>
        <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="https://login.oregonstate.edu/ns/profiles/saml2/sso/ECP/activate" />
      </constructor-arg>
      <constructor-arg value="false" />
    </bean>
  </property>
  <property name="defaultAuthenticationMethods">
    <list>
      <ref bean="MFASAML2Principal" />
      <ref bean="PasswordPrincipal" />
    </list>
  </property>
</bean>

and this in the SP metadata:

<Extensions>
  <mdattr:EntityAttributes>
    <saml:Attribute Name="https://login.oregonstate.edu/ns/profiles/saml2/sso/ECP/activate" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
      <saml:AttributeValue>true</saml:AttributeValue>
    </saml:Attribute>
  </mdattr:EntityAttributes>
</Extensions>

But, I get the following error in idp-process.log:

2021-05-26 23:00:38,063 - 71.238.20.172 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:124] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/ecp is not active for RP configuration shibboleth.DefaultRelyingParty (RPID urn:amazon:webservices)
2021-05-26 23:00:38,078 - 71.238.20.172 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred
while processing the request: InvalidProfileConfiguration

Obviously, the activation condition isn't evaluating to true.  Where did I goof?  How do I create a new MD tag to trigger the activation?

Thanks,
Andy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210527/0a7b8390/attachment.htm>