<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>We are running a non-production instance of IdP V3.2.1 and had a question about how to properly define the PolicyRequirementRule without the legacy types. If I define it as outlined here ( https://wiki.shibboleth.net/confluence/display/IDP30/PolicyRequirementRuleConfiguration ), the attribute-filter.xml fails to load. The log shows this:<br><br><br>2016-08-10 10:02:47,146 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeFilterService': Initial load failed<br>net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 17 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 17; columnNumber: 116; cvc-elt.4.2: Cannot resolve 'Requester' to a type definition for element 'afp:PolicyRequirementRule'.<br> at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)<br>Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 17 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 17; columnNumber: 116; cvc-elt.4.2: Cannot resolve 'Requester' to a type definition for element 'afp:PolicyRequirementRule'.<br> at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)<br>Caused by: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve 'Requester' to a type definition for element 'afp:PolicyRequirementRule'.<br> at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)<br><br><br>The actual PolicyRequirementRule that is throwing the error looks like this:<br> <afp:PolicyRequirementRule xsi:type="Requester" value="https://my.entity.edu/shibboleth" /><br><br><br>If I use the legacy namespace ( https://wiki.shibboleth.net/confluence/display/IDP30/AttributeFilterLegacyNameSpaceMapping ), it loads but throws a warning:<br><br> "Configuration contains at least one element in the deprecated 'urn:mace:shibboleth:2.0:afp:mf:basic' namespace."<br><br>The filter policy that loads with the legacy namespace looks like this:<br> <afp:AttributeFilterPolicy id="SHIB-SP-TST"><br><br> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://my.entity.edu/shibboleth" /><br><br> <afp:AttributeRule attributeID="eduPersonPrincipalName"><br> <afp:PermitValueRule xsi:type="basic:ANY" /><br> </afp:AttributeRule><br><br> </afp:AttributeFilterPolicy><br><br>How might i define the attribute filter policy, so it makes use of the new namespace?<br><br>INFO [net.shibboleth.idp.log.LogbackLoggingService:240] - Shibboleth IdP Version 3.2.1<br><br></div><div><br></div><div><br></div><div>Jay<br></div></div></body></html>