<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.comment
{mso-style-name:comment;}
span.html-tag
{mso-style-name:html-tag;}
span.html-attribute
{mso-style-name:html-attribute;}
span.html-attribute-name
{mso-style-name:html-attribute-name;}
span.html-attribute-value
{mso-style-name:html-attribute-value;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I am setting up a new IdPv3.2.1 system to support InCommon global R&S using this entity attribute matching rule:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"><PolicyRequirementRule</span></code><span class="apple-converted-space"><span style="font-size:10.5pt;color:#333333"> </span></span><code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in">xsi:type="EntityAttributeExactMatch"</span></code><span style="font-size:10.5pt;color:#333333"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"> attributeName="<a href="http://macedir.org/entity-category">http://macedir.org/entity-category"</a></span></code><span style="font-size:10.5pt;color:#333333"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"> attributeValue="<a href="http://refeds.org/category/research-and-scholarship">http://refeds.org/category/research-and-scholarship"</a>/><o:p></o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"> <AttributeRule attributeID=" …<o:p></o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in">However, whenever I test the rule with aacli.bat with an entity ID that should match the rule I receive the following warning in the
idp logs:<o:p></o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></code></p>
<p class="MsoNormal" style="margin-left:.5in;line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in">WARN [net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterEntityAttributeExactPolicyRule:75] - Attribute Filter
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/PolicyRequirementRule:_a8ca67b2900c2ac9c931336eb77ea2ba': Could not locate SP metadata context<o:p></o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in">And no attributes are released. I suspect that the rule match is working because I only see this warning when testing with an entity
ID in the InCommon metadata that has the ‘http://refeds.org…’ attribute, but don’t understand why I am receiving the metadata error. Example entity ID: "https://dmp.cdlib.org"<o:p></o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in">The warning is really similar to
<a href="https://issues.shibboleth.net/jira/browse/IDP-762">https://issues.shibboleth.net/jira/browse/IDP-762</a> but on a different filter type, so I’m unsure if I am doing something wrong or hitting a bug.<o:p></o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<code><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:#333333;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></code></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<span style="font-size:10.5pt;color:#333333">The rule published by InCommon uses the ‘saml’ namespace in the rule type “saml:<code><span style="font-family:"Calibri",sans-serif;border:none windowtext 1.0pt;padding:0in"> EntityAttributeExactMatch”</span></code>
but the SAML schema (urn:mace:shibboleth:2.0:afp:mf:saml?) isn’t included in the default AttributeFilterPolicyGroup tag in IdPv3’s attribute-filter.xml file. There IS a reference to EntityAttributeExactMatch in the included schema (urn:mace:shibboleth:2.0:afp
<a href="http://shibboleth.net/schema/idp/shibboleth-afp.xsd">http://shibboleth.net/schema/idp/shibboleth-afp.xsd</a>):<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<span style="font-size:10.5pt;color:#333333"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;color:black"><!-- The old 'SAML' schema --><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;color:black"><complexType name="EntityAttributeExactMatch"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><span style="font-size:10.0pt;color:black"><annotation><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><span style="font-size:10.0pt;color:black">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Do I need to include the ‘saml’ schema or can I just remove the ‘saml:’ reference from the type value? I am not getting any errors indicating that Shibboleth doesn’t know what ‘EntityAttributeExactMatch’
is so I suspect that the ‘saml:’ reference isn’t necessary, but don’t know for sure.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Matt Rising<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<span style="font-size:10.5pt;color:#333333"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:15.0pt;background:white;vertical-align:baseline">
<span style="font-size:10.5pt;color:#333333"> <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>