<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4275">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: ScriptedAttribute Definition results in Error: "Invalid content was found starting with element 'InputDataConnector'"</title>
</head>
<body>
<div dir="ltr" style="color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">Carl,<div> </div><div>I think Stephen is right, and the analogous 3.3.3 opening elements could instead be like:</div><div> </div><div><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial"> <AttributeDefinition id="securityGroup" xsi:type="ScriptedAttribute"></span><br /><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial"> <DataConnector ref="myLDAP" /></span><span> </span></div><div> </div><div>By defining a dependency on a data connector that returns multiple attributes without further constraint, I believe you get access to all of them. Here's the pre-3.4 documentation:<br /> </div><div>https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=51937741</div><div> </div><div>You can think of an LDAP data connector as returning a bag of individually named attributes and their values. You can also have multiple dependencies. But, if you want to expressly name a sourceAttributeID, that needed to go on the AttributeDefinition element in 3.3.3 and thus applies to all the dependencies, basically the primary schema snafu that led to the partial redesign. Since you've got all the logic built into your script already, the sourceAttributeID isn't really necessary.</div><div> </div><div>By listing no source attribute, you should get access to all the attributes and values that are needed to power your ScriptedAttributeDefinition whether they all come from LDAP or you need more dependencies, so that's what I'd do.</div><div> </div><div>Hope this helps,</div><div>Nate.</div><div> </div></div><div style="color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px" class="gmail_extra"> <div class="gmail_quote">On Thu, Oct 18, 2018 at 1:22 PM, Losen, Stephen C (scl)<span> </span><span dir="ltr"><<a style="color:#1155cc" href="mailto:scl@virginia.edu">scl@virginia.edu</a>></span><span> </span>wrote:<blockquote style="border-left:1px solid #cccccc; margin:0px 0px 0px 0.8ex; padding-left:1ex" class="gmail_quote">Hi Carl,<br /><br />I believe the XML element "InputDataConnector" is not supported until Shib IDP 3.4 and you say you are running 3.3.3.<span> </span><br /><br />Stephen C. Losen<br />ITS - Systems and Storage<br />University of Virginia<br /><a style="color:#1155cc" href="mailto:scl@virginia.edu">scl@virginia.edu</a> 434-924-0640<div class="HOEnZb"><div style="color:#500050" class="h5"><br /><br />-----Original Message-----<br />From: users [mailto:<a style="color:#1155cc" href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] On Behalf Of Daudt, Carl<br />Sent: Thursday, October 18, 2018 2:26 PM<br />To:<span> </span><a style="color:#1155cc" href="mailto:users@shibboleth.net">users@shibboleth.net</a><br />Subject: ScriptedAttribute Definition results in Error: "Invalid content was found starting with element 'InputDataConnector'"<br /><br />I am attempting to convert and migrate a working attribute-resolver.xml attribute definition of type xsi:type="Script" from my IdP v3.2 environment to my new IdP v3.3.3 server, converting it to xsi:type="scriptedAttribute". I am receiving the following error in idp-process.log:<br /><br />2018-10-18 11:37:32,227 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed<br />net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 180 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 180; columnNumber: 84; cvc-complex-type.2.4.a: Invalid content was found starting with element 'InputDataConnector'. One of '{"urn:mace:shibboleth:2.0:resolver":Dependency, "urn:mace:shibboleth:2.0:resolver":DisplayName, "urn:mace:shibboleth:2.0:resolver":DisplayDescription, "urn:mace:shibboleth:2.0:resolver":AttributeEncoder, "urn:mace:shibboleth:2.0:resolver":Script, "urn:mace:shibboleth:2.0:resolver":ScriptFile}' is expected.<br /><br />However, my AttributeDefinition is set up similarly to the last example in the documentation (<a style="color:#1155cc" href="https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition">https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition</a>). Here is my AttributesDefinition in attributes-resolver.xml<br /><br />---BEGIN ScriptedAttribute ATTRIBUTE DEFINITION ON MY IdP v3.3.3 SERVER---<br /> <AttributeDefinition id="securityGroup" xsi:type="ScriptedAttribute"><br /> <InputDataConnector ref="myLDAP" attributeNames="securityGroup memberOf" /><br /><br /> <Script><![CDATA[<br /> (long script omitted)<br /> ]]></Script><br /><br /> <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonAffiliation" encodeType="false" /><br /> <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonAffiliation" encodeType="false" /><br /><br /> </AttributeDefinition><br />---END ---<br /><br />Is there is a problem with the wiki example that I mentioned above? Why is the element 'InputDataConnector' resulting in an "Invalid content" error?<br /><br />FYI, my working AttributeDefinition from my v3.2 environment is as follows:<br /><br />---BEGIN Script ATTRIBUTE DEFINITION ON MY IdP v3.2 SERVER---<br /><resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<br /> id="securityGroup"<br /> sourceAttributeID="eduPersonAffiliation"><br /> <resolver:Dependency ref="myLDAP" /><br /> <resolver:Dependency ref="forScriptWiJava18" /><br /> <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br /> name="urn:mace:dir:attribute-def:eduPersonAffiliation" /><br /> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br /> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"<br /> friendlyName="eduPersonAffiliation" /><br /><br /> <Script><![CDATA[<br /> (long script omitted)<br /> ]]></Script><br /></resolver:AttributeDefinition><br />---END ---<br /><br /><br />Carl R. Daudt<br />Enterprise Applications Systems Analyst, Information Technology<br />Taylor University<br /><br /><br />The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.<br />--<span> </span><br />For Consortium Member technical support, see<span> </span><a style="color:#1155cc" href="https://wiki.shibboleth.net/confluence/x/coFAAg">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br />To unsubscribe from this list send an email to<span> </span><a style="color:#1155cc" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br />--<span> </span><br />For Consortium Member technical support, see<span> </span><a style="color:#1155cc" href="https://wiki.shibboleth.net/confluence/x/coFAAg">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br />To unsubscribe from this list send an email to<span> </span><a style="color:#1155cc" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div></div><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px"><pre style="white-space:pre-wrap; word-wrap:break-word"><a href="mailto:users-unsubscribe@shibboleth.net"> </a>
</pre></blockquote>
</body>
</html>