<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi,<br>
</p>
<p>Im upgrading our IdP from v2 to v3. I've modified ldap.properties
and ldap-auth.config to check multiple OU's based on the examples
in the docs. So I have idp.authn.LDAP.baseDN1 through
idp.authn.LDAP.baseDN4 and the same goes for most of the other
things in ldap.properties. <br>
</p>
<p>Thats a problem when it reads the dataconnector in
attribute-resolver though, by default theres a call to 1 server. I
saw on the <a
href="https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration#DataConnectorConfiguration-%3CFailoverDataConnector%3E">DataConnectorConfiguration</a>
doc that <FailoverDataConnector> is still supported, so I
thought I could basically replicate what I have on my v2 server
but I get this error about <LDAPProperty>. It looks like a
syntax error but I cant find anything wrong. Is there another way
I should be doing this?<br>
</p>
<p>net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException:
Line 131 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid;
nested exception is org.xml.sax.SAXParseException; lineNumber:
131; columnNumber: 64; cvc-complex-type.2.4.a: Invalid content was
found starting with element 'dc:LDAPProperty'. One of
'{"urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential,
"urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool,
"urn:mace:shibboleth:2.0:resolver:dc":Column,
"urn:mace:shibboleth:2.0:resolver:dc":ResultCache,
"urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is
expected.<br>
at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)<br>
Caused by:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException:
Line 131 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid;
nested exception is org.xml.sax.SAXParseException; lineNumber:
131; columnNumber: 64; cvc-complex-type.2.4.a: Invalid content was
found starting with element 'dc:LDAPProperty'. One of
'{"urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential,
"urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool,
"urn:mace:shibboleth:2.0:resolver:dc":Column,
"urn:mace:shibboleth:2.0:resolver:dc":ResultCache,
"urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is
expected.<br>
at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)<br>
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a:
Invalid content was found starting with element 'dc:LDAPProperty'.
One of
'{"urn:mace:shibboleth:2.0:resolver:dc":StartTLSAuthenticationCredential,
"urn:mace:shibboleth:2.0:resolver:dc":ConnectionPool,
"urn:mace:shibboleth:2.0:resolver:dc":Column,
"urn:mace:shibboleth:2.0:resolver:dc":ResultCache,
"urn:mace:shibboleth:2.0:resolver:dc":ResultCacheBean}' is
expected.<br>
at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)<br>
<br>
</p>
<p>This is the dataconnector from attribute-resolver, its followed
by another dataconnector but instead of ldapURL1 it has ldapURL2
and so on. <br>
</p>
<p> <resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory"<br>
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL1}"<br>
baseDN="%{idp.attribute.resolver.LDAP.baseDN1}" <br>
principal="%{idp.attribute.resolver.LDAP.bindDN1}"<br>
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential1}"<br>
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS1::true}"><br>
<br>
<resolver:FailoverDataConnector ref="myLDAP2" /><br>
<br>
<dc:FilterTemplate><br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.searchFilter}<br>
]]><br>
</dc:FilterTemplate><br>
<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes><br>
<dc:StartTLSTrustCredential id="LDAPtoIdPCredential"
xsi:type="sec:X509ResourceBacked"><br>
<sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><br>
</dc:StartTLSTrustCredential><br>
<br>
<dc:LDAPProperty name="java.naming.referral"
value="follow"/><br>
<br>
</resolver:DataConnector><br>
<br>
</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>