<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Which version of the IdP are you running? Requester was only added in 3.3 AFAIK, not 3.2 as mentioned on this page. Try basic:AttributeRequesterString instead.</p>
<p><br>
</p>
<p><a href="https://wiki.shibboleth.net/confluence/display/IDP30/RequesterConfiguration" class="OWAAutoLink" id="LPlnk995252" previewremoved="true">https://wiki.shibboleth.net/confluence/display/IDP30/RequesterConfiguration</a><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Richard Genthner <richard@guthnur.net><br>
<b>Sent:</b> Wednesday, June 21, 2017 12:15:47 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Shibboleth IDP 3 and Onelogin PHP SAML library</font>
<div> </div>
</div>
<div>
<div dir="ltr">according to the doc's I believe this should work:
<div><br>
</div>
<div>
<div> <afp:AttributeFilterPolicy id="wheniwork"></div>
<div> <afp:PolicyRequirementRule xsi:type="Requester" value="<a href="https://saml.example.com/682879">https://saml.example.com/682879</a>" /></div>
<div> <afp:AttributeRule attributeID="firstName"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </afp:AttributeRule></div>
<div> <afp:AttributeRule attributeID="lastName"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </afp:AttributeRule></div>
<div> <afp:AttributeRule attributeID="mail"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </afp:AttributeRule></div>
<div> <afp:AttributeRule attributeID="eduPersonPrincipalName"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </afp:AttributeRule></div>
<div> </afp:AttributeFilterPolicy></div>
<div><br>
</div>
<div>it would seem its doesn't like PolicyRequirementRule's xsi:type of Requester.</div>
<div><br>
</div>
<div><br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Wed, Jun 21, 2017 at 3:08 PM Klingenstein, Nate <<a href="mailto:nklingenstein@calstate.edu">nklingenstein@calstate.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div id="m_-8695948276686177696divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p>This one jumps out at me:</p>
<p><br>
</p>
<p></p>
<div>7-06-21 19:03:30,577 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeFilterService': Initial load failed
<table class="m_-8695948276686177696highlight m_-8695948276686177696tab-size m_-8695948276686177696js-file-line-container">
<tbody>
<tr>
<td id="m_-8695948276686177696file-idp-process-log-LC27" class="m_-8695948276686177696blob-code m_-8695948276686177696blob-code-inner m_-8695948276686177696js-file-line">
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 59 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException;
lineNumber: 59; columnNumber: 90; cvc-complex-type.2.4.a: Invalid content was found starting with element 'PolicyRequirementRule'. One of '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule, "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}'
is expected.</td>
</tr>
<tr>
</tr>
</tbody>
</table>
<table class="m_-8695948276686177696highlight m_-8695948276686177696tab-size m_-8695948276686177696js-file-line-container">
<tbody>
<tr>
<td id="m_-8695948276686177696file-idp-process-log-LC28" class="m_-8695948276686177696blob-code m_-8695948276686177696blob-code-inner m_-8695948276686177696js-file-line">
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)</td>
</tr>
<tr>
</tr>
</tbody>
</table>
<table class="m_-8695948276686177696highlight m_-8695948276686177696tab-size m_-8695948276686177696js-file-line-container">
<tbody>
<tr>
<td id="m_-8695948276686177696file-idp-process-log-LC29" class="m_-8695948276686177696blob-code m_-8695948276686177696blob-code-inner m_-8695948276686177696js-file-line">
Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 59 in XML document from file [/opt/shibboleth-idp/conf/attribute-filter.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 59; columnNumber:
90; cvc-complex-type.2.4.a: Invalid content was found starting with element 'PolicyRequirementRule'. One of '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule, "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}' is expected.</td>
</tr>
<tr>
</tr>
</tbody>
</table>
<table class="m_-8695948276686177696highlight m_-8695948276686177696tab-size m_-8695948276686177696js-file-line-container">
<tbody>
<tr>
<td id="m_-8695948276686177696file-idp-process-log-LC30" class="m_-8695948276686177696blob-code m_-8695948276686177696blob-code-inner m_-8695948276686177696js-file-line">
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)</td>
</tr>
<tr>
</tr>
</tbody>
</table>
<table class="m_-8695948276686177696highlight m_-8695948276686177696tab-size m_-8695948276686177696js-file-line-container">
<tbody>
<tr>
<td id="m_-8695948276686177696file-idp-process-log-LC31" class="m_-8695948276686177696blob-code m_-8695948276686177696blob-code-inner m_-8695948276686177696js-file-line">
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'PolicyRequirementRule'. One of '{"urn:mace:shibboleth:2.0:afp":PolicyRequirementRule, "urn:mace:shibboleth:2.0:afp":PolicyRequirementRuleReference}'
is expected.</td>
</tr>
<tr>
</tr>
</tbody>
</table>
at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)</div>
<br>
<p></p>
</div>
<hr style="display:inline-block;width:98%">
<div id="m_-8695948276686177696divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of
Richard Genthner <<a href="mailto:richard@guthnur.net" target="_blank">richard@guthnur.net</a>><br>
<b>Sent:</b> Wednesday, June 21, 2017 12:06:45 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Shibboleth IDP 3 and Onelogin PHP SAML library</font>
<div> </div>
</div>
</div>
<div>
<div>
<div dir="ltr">I'm not seeing anything jumping out to me in the idp-process log. <a href="https://gist.github.com/moos3/8fd87c678c06a53820aa3385e3be1584" target="_blank">https://gist.github.com/moos3/8fd87c678c06a53820aa3385e3be1584</a></div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Wed, Jun 21, 2017 at 2:56 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 6/21/17, 2:39 PM, "users on behalf of Richard Genthner" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:richard@guthnur.net" target="_blank">richard@guthnur.net</a>> wrote:<br>
<br>
<br>
> I did some digging around and tried adding this to the saml-nameid.xml file<br>
<br>
That *is* how to do it, the filter rule is either irrelevant if you choose to source the NameID via an unfiltered "mail" attribute, or just requires that you release the attribute, which you did.<br>
<br>
> but doesn't seem to fix the issue. Thoughts ????<br>
<br>
I can only tell you how to do it, which you found, and that you absolutely without question shouldn't do it. The rest is log analysis.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
</div>
</div>
</div>
</body>
</html>