<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Here is the entire attribute-filter.xml:<br></div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?><br><afp:AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"<br> xmlns:afp="urn:mace:shibboleth:2.0:afp" xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic" <br> xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <br> xsi:schemaLocation="urn:mace:shibboleth:2.0:afp classpath:/schema/shibboleth-2.0-afp.xsd<br> urn:mace:shibboleth:2.0:afp:mf:basic classpath:/schema/shibboleth-2.0-afp-mf-basic.xsd<br> urn:mace:shibboleth:2.0:afp:mf:saml classpath:/schema/shibboleth-2.0-afp-mf-saml.xsd"><br><br> <!-- Release the transient ID to anyone --><br> <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone"><br> <afp:PolicyRequirementRule xsi:type="basic:ANY"/><br><br> <afp:AttributeRule attributeID="transientId"><br> <afp:PermitValueRule xsi:type="basic:ANY"/><br> </afp:AttributeRule><br> <afp:AttributeRule attributeID="eduPersonScopedAffiliation"><br> <afp:PermitValueRule xsi:type="basic:ANY" /><br> </afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br><br> <afp:AttributeFilterPolicy id="releaseSpecificAttributes"><br> <afp:PolicyRequirementRule xsi:type="basic:ANY"/><br> <afp:AttributeRule attributeID="eduPersonAffiliation"><br> <afp:PermitValueRule xsi:type="basic:OR" ><br> <basic:Rule xsi:type="basic:AttributeValueString" value="faculty" ignoreCase="true"/><br> <basic:Rule xsi:type="basic:AttributeValueString" value="student" ignoreCase="true"/><br> <basic:Rule xsi:type="basic:AttributeValueString" value="staff" ignoreCase="true" /><br> <basic:Rule xsi:type="basic:AttributeValueString" value="alum" ignoreCase="true" /><br> <basic:Rule xsi:type="basic:AttributeValueString" value="member" ignoreCase="true" /><br> <basic:Rule xsi:type="basic:AttributeValueString" value="affiliate" ignoreCase="true" /><br> <basic:Rule xsi:type="basic:AttributeValueString" value="employee" ignoreCase="true" /><br> <basic:Rule xsi:type="basic:AttributeValueString" value="library-walk-in" ignoreCase="true" /><br> </afp:PermitValueRule><br> </afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br></afp:AttributeFilterPolicyGroup><br></div><div><br></div><div><br></div><div>Returns this error message:<br></div><div><br></div><div>12:13:56.927 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:72] - Parsing configuration for attribute filter policy releaseTransientIdToAnyone<br>12:13:56.938 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:72] - Parsing configuration for attribute filter policy releaseSpecificAttributes<br>12:13:56.941 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components. The root cause of this error was: org.springframework.beans.factory.BeanCreationException: RuleReference elements within an AND rule are not supported<br></div><div><br></div><div>I don't see where the problem is.<br></div><div><br></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Scott Cantor" <cantor.2@osu.edu><br><b>To: </b>"Shib Users" <users@shibboleth.net><br><b>Sent: </b>Monday, July 1, 2013 11:26:26 AM<br><b>Subject: </b>RE: attribute filter rule "PermitValueRule" not working<br><div><br></div>> <afp:AttributeFilterPolicy id="releaseSpecificAttributes"><br>> <afp:PolicyRequirementRule xsi:type="basic:ANY"/><br>> <afp:AttributeRule attributeID="eduPersonAffiliation"><br>> <afp:PermitValueRule xsi:type="basic:OR" ><br>> <basic:Rule xsi:type="basic:AttributeValueString" value="faculty"<br>> ignoreCase="true"/><br>> <basic:Rule xsi:type="basic:AttributeValueString" value="student"<br>> ignoreCase="true"/><br>> <basic:Rule xsi:type="AttributeValueString" value="staff"<br>> ignoreCase="true" /><br><div><br></div>Well, I suspect that might not work unless the default namespace is the one corresponding to "basic", but that isn't the error you showed.<br><div><br></div>> idp-process.log on startup ...<br>> <br>> 09:46:40.325 - ERROR<br>> [edu.internet2.middleware.shibboleth.common.config.BaseService:188] -<br>> Configuration was not loaded for shibboleth.AttributeFilterEngine service,<br>> error creating components. The root cause of this error was:<br>> org.springframework.beans.factory.BeanCreationException: RuleReference<br>> elements within an AND rule are not supported<br><div><br></div>That should be self-explanatory, you have an AND rule you didn't show, and it's got a RuleReference inside, which wasn't handled by the code, so isn't supported.<br><div><br></div>-- Scott<br><div><br></div>--<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div><div><br></div></div></body></html>