MDDriven ECP profile activation

[Andrew Jason Morgan]

Aha, understood!  I changed the propertyName in relying-party.xml to "activationCondition" and updated the SP metadata to:

<saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/sso/ecp/activationCondition" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
  <saml:AttributeValue>true</saml:AttributeValue>
</saml:Attribute>

It works as expected.  Thanks for clarifying!

Andy


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, May 27, 2021 5:26 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: MDDriven ECP profile activation

[This email originated from outside of OSU. Use caution with links and attachments.]

On 5/27/21, 2:13 AM, "users on behalf of Andrew Jason Morgan" <users-bounces at shibboleth.net on behalf of morgan at oregonstate.edu> wrote:

>  Where did I goof?  How do I create a new MD tag to trigger the activation?

You're misappropriating the propertyName in that wiring to mean the name of your metadata tag, it's not. The property name in those functions is the name of the setting in the configuration, which is activationCondition, as in the example. The tag name should be "https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fshibboleth.net%2Fns%2Fprofiles%2Fsaml2%2Fsso%2Fecp%2FactivationCondition&data=04%7C01%7C%7C7237e4440b7740d0418a08d9210aaffc%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637577152052904625%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=6l3nVHolVfSyE5Xy7IXhFnsnRSBoAcYhbHG4euOqeds%3D&reserved=0", which is what all that code tries to find unless you add more settings (for no obvious reason) to change the name of the tag it looks for.

I didn't actually include the metadata in the example, I'll add it.

-- Scott


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7C%7C7237e4440b7740d0418a08d9210aaffc%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637577152052914616%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FJJ8nRB9RcOWwLU6NJleSmMosnm%2BjxKlJ6ddsQQ4D6w%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210527/7f56c4c8/attachment.htm>