<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="monospace">Hello,<br>
<br>
Our environment is running IdP v4.2.1 (directly updated from
v3.4.8) on CentOS 7 with OpenJDK 11 and Tomcat 9.0.62.<br>
<br>
On v3.x, we had the following override example defined in
relying-party.xml to enable conditional signing/encryption, which
worked fine without any issues:<br>
<br>
<br>
<bean id="SignNoIntegrity"
class="org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate"
/><br>
<bean id="EncryptNoConfidentiality"
class="org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate"
/><br>
<br>
...<br>
<br>
<bean parent="</font><font face="monospace"><span data-code-lang="xml" data-ds--code--code-block="" class="prismjs
css-1yzxpbn"><code class="language-xml" style="white-space: pre;"><span class="token tag attr-value">RelyingPartyByName</span><span class="token tag attr-value punctuation"></span></code></span>"
c:relyingPartyIds=<a class="moz-txt-link-rfc2396E" href="https://sp.example.org">"https://sp.example.org"</a>><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"
p:signAssertions-ref="SignNoIntegrity"
p:encryptAssertions-ref="EncryptNoConfidentiality" /><br>
</list><br>
</property><br>
</bean><br>
<br>
<br>
<br>
This same relying-party.xml definition (which is identical in 4.x,
according to
<a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631697/SecurityConfiguration#Conditional-Signing-or-Encryption">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631697/SecurityConfiguration#Conditional-Signing-or-Encryption</a>
), however, is not loading properly with v4.2.1:<br>
<br>
<br>
ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:232]
- 127.0.0.1 - Service 'shibboleth.RelyingPartyResolverService':
Reload for shibboleth.RelyingPartyResolverService failed<br>
net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'shibboleth.RelyingPartyOverrides': Cannot
create inner bean 'RelyingPartyByName$child#82f96b9' of type
[net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport]
while setting bean property 'sourceList' with key [5]; nested
exception is
org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'RelyingPartyByName$child#82f96b9' defined
in file [/opt/shibboleth-idp/conf/relying-party.xml]: Cannot
create inner bean 'SAML2.SSO$child#6eb32834' of type
[net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration]
while setting bean property 'profileConfigurations' with key [0];
nested exception is
org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'SAML2.SSO$child#6eb32834' defined in file
[/opt/shibboleth-idp/conf/relying-party.xml]: Initialization of
bean failed; nested exception is
org.springframework.beans.TypeMismatchException: Failed to convert
property value of type
'org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate'
to required type 'boolean' for property 'encryptAssertions';
nested exception is java.lang.IllegalArgumentException: Cannot
convert value of type
'org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate'
to required type 'boolean' for property 'encryptAssertions':
PropertyEditor
[org.springframework.beans.propertyeditors.CustomBooleanEditor]
returned inappropriate value of type
'org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate'<br>
at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)<br>
...<br>
Caused by: java.lang.IllegalArgumentException: Cannot convert
value of type
'org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate'
to required type 'boolean' for property 'encryptAssertions':
PropertyEditor
[org.springframework.beans.propertyeditors.CustomBooleanEditor]
returned inappropriate value of type
'org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate'<br>
at
org.springframework.beans.TypeConverterDelegate.convertIfNecessary(TypeConverterDelegate.java:258)<br>
<br>
<br>
<br>
Is this error due to the predicate syntax changes between v3 and
v4 outlined at
<a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631499/ReleaseNotes#Profile-Configuration-APIs">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631499/ReleaseNotes#Profile-Configuration-APIs</a>
? If so, what would be the correct way to define these
conditional signing/encryption overrides? Thanks in advance.<br>
<br>
<br>
-Gabor<br>
<br>
</font>
</body>
</html>