<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Mahalo to Phil Pishioneri who spotted the problem and suggested the solution to me: missing ">" at the end of the p:attributeSourceIds line, which yields the working entry:<br></div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div dir="ltr"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div dir="ltr"> p:attributeSourceIds="#{ {'attrEmail_aberrant'} }" ></div><div dir="ltr"> <property name="activationCondition"></div><div dir="ltr"> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="SP_entityID_aberrant" /></div><div dir="ltr"> </property></div><div dir="ltr"> </bean></div><div dir="ltr"><br></div><div>Since I only expect to use this exception and custom attrEmail_aberrant attribute for this particular SP, I think the c:candidate="SP_entityID_aberrant" is probably fine. This form is provided as an example for a single SP here:</div><div><<a href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-SpecificRelyingParties">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-SpecificRelyingParties</a>>.</div><div>If this were applicable to multiple SPs, you're right I'd want the plural candidates form.</div></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Mar 11, 2021 at 8:01 AM IAM David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div><div dir=""><div dir="ltr">
<p style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)" dir="ltr"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)">maybe...</span></p><p style="margin:0px;font-stretch:normal;line-height:normal" dir="ltr"><span style="color:rgb(46,174,187);font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures"> </span><span style="color:rgb(47,180,29);font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures">c</span><span style="color:rgb(64,11,217);font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures">:</span><span style="color:rgb(47,180,29);font-family:Menlo;font-variant-ligatures:no-common-ligatures"><span style="font-size:11px">candidate</span><u><b style="font-size:14px">s</b></u></span><span style="color:rgb(0,0,0);font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures">=</span><span style="color:rgb(180,36,25);font-family:Menlo;font-size:11px;font-variant-ligatures:no-common-ligatures">"#{ {‘<span style="color:rgb(120,120,120);font-family:-apple-system;font-size:13px">SP_entityID_aberrant'</span></span><font color="#b42419" face="Menlo"><span style="font-size:11px"> } }</span><span style="font-size:11px">”</span><span style="font-size:11px"> ...</span></font></p><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 11Mar, 2021 at 08:42:04, Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">I was able to script an attribute, attrEmail_aberrant, suitable for this SP, but ran into an XML parsing error trying to use it via an activation condition in saml-nameid.xml with the following entry:</div><div dir="ltr"><div><br></div><div><div> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div> p:attributeSourceIds="#{ {'attrEmail_aberrant'} }"</div><div> <property name="activationCondition"></div><div> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="SP_entityID_aberrant" /></div><div> </property></div><div> </bean></div></div><div><br></div><div>Error when I reload:</div><div><br></div><div><div>ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231] - Service 'shibboleth.NameIdentifierGenerationService': Reload for shibboleth.NameIdentifierGenerationService failed</div><div>net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 64 in XML document from file [/home/shib/idp/conf/saml-nameid.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 64; columnNumber: 13; Element type "bean" must be followed by either attribute specifications, ">" or "/>".</div></div></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Mar 10, 2021 at 9:06 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">On 3/10/21, 1:03 PM, "users on behalf of Baron Fujimoto" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> wrote:<br>
<br>
> I'm afraid my grasp of IdP-initiated SPs is poor and I don't yet have an inkling how we might begin to<br>
> implement these possibilities without more explicit documentation or examples.<br>
<br>
That's the benefit of membership, to be brutally frank.<br>
<br>
> Getting back to the original suggestion by Gary Lipscomb, may we can kludge that after all, assuming we can<br>
> have multiple SAML2AttributeSourcedGenerator beans in saml-nameid.xml that use result in the same nameid<br>
> format, but use different attributeSourceID. If so, would these beans be order dependent on a first match basis<br>
> (like metadata?). Ie. something like this?<br>
<br>
Yes, that is probably the best fix for this issue, just release the unusual source attribute to just that SP and then it won't ever run successfully for any other, generators just fall through if they have nothing to operate on.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr">Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> :: UH Information Technology Services<br>minutas cantorum, minutas balorum, minutas carboratum desendus pantorum</div></div>
<div>
<div>
-- <br>For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
</div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> :: UH Information Technology Services<br>minutas cantorum, minutas balorum, minutas carboratum desendus pantorum</div></div>