<div dir="ltr">So I have updated my attribute-filters.xml file for idp 3 syntax<div><br></div><div><div><AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"</div><div> xmlns="urn:mace:shibboleth:2.0:afp"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div> xsi:schemaLocation="urn:mace:shibboleth:2.0:afp <a href="http://shibboleth.net/schema/idp/shibboleth-afp.xsd">http://shibboleth.net/schema/idp/shibboleth-afp.xsd</a>"></div><div><br></div><div> <!-- Release some attributes to an SP. --></div><div> <AttributeFilterPolicy id="onelogin-php-saml"></div><div> <PolicyRequirementRule xsi:type="Requester" value="<a href="https://saml.example.com/682879">https://saml.example.com/682879</a>" /></div><div><br></div><div> <AttributeRule attributeID="eduPersonPrincipalName"></div><div> <PermitValueRule xsi:type="ANY" /></div><div> </AttributeRule></div><div><br></div><div> <AttributeRule attributeID="uid"></div><div> <PermitValueRule xsi:type="ANY" /></div><div> </AttributeRule></div><div><br></div><div> <AttributeRule attributeID="mail"></div><div> <PermitValueRule xsi:type="ANY" /><?xml version="1.0" encoding="UTF-8"?></div><div><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>"</div><div> xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"</div><div> xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>"</div><div> xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>"</div><div> xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div> xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a></div><div> <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a></div><div> <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"</div><div><br></div><div> default-init-method="initialize"</div><div> default-destroy-method="destroy"></div><div><br></div><div> <!-- ========================= SAML NameID Generation ========================= --></div><div><br></div><div> <!--</div><div> These generator lists handle NameID/Nameidentifier generation going forward. By default,</div><div> transient IDs for both SAML versions are enabled. The commented examples are for persistent IDs</div><div> and generating more one-off formats based on resolved attributes. The suggested approach is to</div><div> control their use via release of the underlying source attribute in the filter policy rather</div><div> than here, but you can set a property on any generator called "activationCondition" to limit</div><div> use in the most generic way.</div><div><br></div><div> Most of the relevant configuration settings are controlled using properties; an exception is</div><div> the generation of arbitrary/custom formats based on attribute information, examples of which</div><div> are shown below.</div><div><br></div><div> --></div><div><br></div><div> <!-- SAML 2 NameID Generation --></div><div> <util:list id="shibboleth.SAML2NameIDGenerators"></div><div><br></div><div> <ref bean="shibboleth.SAML2TransientGenerator" /></div><div><br></div><div> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --></div><div> <!--</div><div> <ref bean="shibboleth.SAML2PersistentGenerator" /></div><div> --></div><div><br></div><div> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div> p:attributeSourceIds="#{ {'mail'} }" /></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> p:omitQualifiers="true"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> p:attributeSourceIds="#{ {'mail'} }"></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <property name="activationCondition"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="https://saml.example.com/682879">https://saml.example.com/682879</a>" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> </property></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></bean></div><div><br></div><div> </util:list></div><div><br></div><div> <!-- SAML 1 NameIdentifier Generation --></div><div> <util:list id="shibboleth.SAML1NameIdentifierGenerators"></div><div><br></div><div> <ref bean="shibboleth.SAML1TransientGenerator" /></div><div><br></div><div> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"</div><div> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div> p:attributeSourceIds="#{ {'mail'} }" /></div><div><br></div><div> </util:list></div><div><br></div><div></beans></div><div> </AttributeRule></div><div><br></div><div> <AttributeRule attributeID="firstName"></div><div> <PermitValueRule xsi:type="ANY" /></div><div> </AttributeRule></div><div><br></div><div> <AttributeRule attributeID="lastName"></div><div> <PermitValueRule xsi:type="ANY" /></div><div> </AttributeRule></div><div><br></div><div> </AttributeFilterPolicy></div><div><br></div><div></AttributeFilterPolicyGroup></div></div><div><br></div><div><br></div><div>here is the latest log <a href="https://gist.github.com/moos3/65795e5ae3538c8feef9c5780f077be7">https://gist.github.com/moos3/65795e5ae3538c8feef9c5780f077be7</a> I dont get why its invalid now. My saml-nameid.xml is as follows:</div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Jun 21, 2017 at 3:38 PM Richard Genthner <<a href="mailto:richard@guthnur.net">richard@guthnur.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Ok I haven't touched shib idp since 2.5.x, so that might be my issue here. I'll redo my configuration files and see if that fixes it.</div><br><div class="gmail_quote"><div dir="ltr">On Wed, Jun 21, 2017 at 3:24 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 6/21/17, 3:15 PM, "users on behalf of Richard Genthner" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:richard@guthnur.net" target="_blank">richard@guthnur.net</a>> wrote:<br>
<br>
> according to the doc's I believe this should work:<br>
<br>
You're mixing namespace styles and syntaxes here, but offhand I would say that you don't have a default namespace declared and therefore "Requester" is an unqualified QName that isn't the same as afp:Requester. I don't know what version you're using or which language variant you're trying to use, but mixing the old stuff with split namespaces (afp, basic, saml prefixes) with the newer flattened version is not a great choice.<br>
<br>
Basically, set xmlns="..." to what afp is bound to, get rid of all references to basic and afp prefixes and then fix any bugs. It's a largely mechanical translation to get off the old syntax and then it will be done.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></blockquote></div>