<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Wed, 9 Jul 2014, at 10:14 , Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:</div><blockquote type="cite"><br>What does your resolver and cache configuration look like?<br></blockquote><div>...</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"><<span style="color: #0220b3; background-color: #e6e600">!</span>-- Schema: eduPerson attributes --></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span><span style="color: #2cb6c3"><</span><span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span><span style="color: #2cb6c3">AttributeDefinition </span><span style="color: #2cb820">id</span><span style="color: #000000">=</span>"eduPersonAffiliation"<span style="color: #2cb6c3"> </span><span style="color: #2cb820">xsi</span><span style="color: #4f2dde">:</span><span style="color: #2cb820">type</span><span style="color: #000000">=</span>"Script"<span style="color: #2cb6c3"> </span><span style="color: #2cb820">xmlns</span><span style="color: #000000">=</span>"urn:mace:shibboleth:2.0:resolver:ad"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: #2cb6c3"> </span><span style="color: #2cb820">sourceAttributeID</span><span style="color: #000000">=</span>"eduPersonAffiliation"<span style="color: #2cb6c3">></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span><<span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span>Dependency <span style="color: #2cb820">ref</span><span style="color: #000000">=</span><span style="color: #bf341d">"myLDAP"</span> /></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"><<span style="color: #0220b3; background-color: #e6e600">!</span>-- Do not encode ePA directly; rather, use uakePA with processing to add Member or Affiliate as appropriate</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"> We need to retain the definnition, though, because other attributes (including uakePA) have ePA dependency.</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"> <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"> name="urn:mace:dir:attribute-def:eduPersonAffiliation" /></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" friendlyName="eduPersonAffiliation" /></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);">--></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span><Script></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <span style="color: #2cb820"><</span><span style="color: #00a500; background-color: #e6e600">!</span><span style="color: #2cb820">[</span><span style="color: #c97520">CDATA</span><span style="color: #2cb820">[</span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"> importPackage(Packages.org.slf4j);</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"> if (eduPersonAffiliation == null) {eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");}</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"> <span style="color: #2cb820">]]></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span></Script></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span></<span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span>AttributeDefinition></div><div>...</div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"><<span style="color: #0220b3; background-color: #e6e600">!</span>-- LDAP Connector to edir, a multi-node cluster of LDAP directories --></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span><span style="color: #2cb6c3"><</span><span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span><span style="color: #2cb6c3">DataConnector </span><span style="color: #2cb820">id</span><span style="color: #000000">=</span>"myLDAP"<span style="color: #2cb6c3"> </span><span style="color: #2cb820">xsi</span><span style="color: #4f2dde">:</span><span style="color: #2cb820">type</span><span style="color: #000000">=</span>"LDAPDirectory"<span style="color: #2cb6c3"> </span><span style="color: #2cb820">xmlns</span><span style="color: #000000">=</span>"urn:mace:shibboleth:2.0:resolver:dc"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: #2cb6c3"> </span><span style="color: #2cb820">ldapURL</span><span style="color: #000000">=</span>"<a href="ldaps://edir.alaska.edu:636">ldaps://edir.alaska.edu:636</a>"<span style="color: #2cb6c3"> </span><span style="color: #2cb820">baseDN</span><span style="color: #000000">=</span>"ou=people,dc=alaska,dc=edu"<span style="color: #2cb6c3"> </span></div><div style="margin: 0px; font-size: 11px; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="font-family: Monaco; color: rgb(44, 182, 195);"> </span><span style="font-family: Monaco; color: rgb(44, 184, 32);">principal</span><span style="font-family: Monaco; color: rgb(0, 0, 0);">=</span><font face="Monaco">"uid=shibboleth03,ou=resource,dc=alaska,dc=edu"</font><span style="font-family: Monaco; color: rgb(44, 182, 195);"> </span><span style="font-family: Monaco; color: rgb(44, 184, 32);">principalCredential</span><span style="font-family: Monaco; color: rgb(0, 0, 0);">="</span><font face="Lucida Sans"><i>These are not the credentials you’re looking for</i></font><span style="font-family: Monaco;">"<span style="color: #2cb6c3">></span></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span><<span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span>FailoverDataConnector <span style="color: #2cb820">ref</span><span style="color: #000000">=</span><span style="color: #bf341d">"FailoverStaticConnector"</span> /></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span><FilterTemplate></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <span style="color: #2cb820"><</span><span style="color: #00a500; background-color: #e6e600">!</span><span style="color: #2cb820">[</span><span style="color: #c97520">CDATA</span><span style="color: #2cb820">[</span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"> (|(uid=$requestContext.principalName)(uasystemid=$requestContext.principalName)(bannerid=$requestContext.principalName))</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"> <span style="color: #2cb820">]]></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span></FilterTemplate></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"><<span style="color: #0220b3; background-color: #e6e600">!</span>-- <ResultCache elementTimeToLive="PT1H" maximumCachedElements="100"/> --></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: #000000"> </span></<span style="color: #d036cf">resolver</span><span style="color: #4f2dde">:</span>DataConnector></div></div><div><br></div><div>Cache statement is currently commented out, which resolved the functional failure.</div><div><br></div><div>David Bantz</div></div></body></html>