<div dir="ltr">Hey Everyone,<div><br></div><div>So I think I'm finally nearing the end of this setup. I've worked through all of the errors in the IdP logs. </div><div><br></div><div>I have one last set I'm scratching my head on. Here are the attributes I'm using. I'd like to have shibboleth query the Username and group membership from AD. I pasted that below then under that are the logs. </div><div><br></div><div><AttributeResolver<br>     xmlns="urn:mace:shibboleth:2.0:resolver" <br>        xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" <br>        xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver <a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd</a>"><br><br><br>    <!-- ========================================== --><br>    <!--      Attribute Definitions                 --><br>    <!-- ========================================== --><br>  <AttributeDefinition id="principalName" xsi:type="Scoped" scope="i*.*.mil"><br>               <InputDataConnector ref="myLDAP" attributeNames="sAMAccountName"/><br>          <AttributeEncoder xsi:type="SAML2String" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos" /><br> </AttributeDefinition><br><br><br>    <AttributeDefinition id="isMemberOfRecursive" xsi:type="Simple"><br>            <InputDataConnector ref="ADGroup" attributeNames="cn"/><br>             <AttributeEncoder xsi:type="SAML2String" name="urn:oid:31 A1 BB BE 05 3C A5 43" friendlyName="isMemberOf" /><br>      </AttributeDefinition><br><br><br>    <!-- ========================================== --><br>    <!--      Data Connectors                       --><br>    <!-- ========================================== --><br><br>    <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br>        principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"<br>        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<br>        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br>        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"><br>        <FilterTemplate><br>            <![CDATA[<br>                %{idp.attribute.resolver.LDAP.searchFilter}<br>            ]]><br>        </FilterTemplate><br>     <ConnectionPool<br>            minPoolSize="%{idp.pool.LDAP.minSize:3}"<br>            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br>            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br>            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br>            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br>            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"<br>            failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" /><br>    </DataConnector><br></AttributeResolver><br></div><div><br></div><div><br></div><div>Below are the logs I'm receiving. These are the only errors I've received but I'm unsure where the "name" attribute should be placed. </div><div><br></div><div>ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] - Service 'shibboleth.AttributeRegistryService': Initial load failed<br>net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanDefinitionStoreException: Missing 'name' attribute, cannot create transcoder rule<br>     at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)<br>Caused by: org.springframework.beans.factory.BeanDefinitionStoreException: Missing 'name' attribute, cannot create transcoder rule<br>   at net.shibboleth.idp.attribute.resolver.spring.enc.BaseSAML2AttributeEncoderParser.doParse(BaseSAML2AttributeEncoderParser.java:46)<br>2022-12-06 07:46:49,978 -  - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:185] - Service 'shibboleth.AttributeRegistryService': No further attempts will be made to reload<br>2022-12-06 07:46:49,994 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:173] - Service 'shibboleth.MetadataResolverService': Performing initial load<br>2022-12-06 07:46:49,994 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:259] - Service 'shibboleth.MetadataResolverService': Reloading service configuration<br>2022-12-06 07:46:49,994 -  - INFO [net.shibboleth.ext.spring.util.ApplicationContextBuilder:346] - Skipping non-existent resource: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/system/conf/metadata-providers-system.xml]<br>2022-12-06 07:46:50,244 -  - ERROR [net.shibboleth.idp.saml.metadata.impl.AttributeMappingNodeProcessor:112] - Attribute transcoding service unavailable<br>2022-12-06 07:46:50,244 -  - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:591] - Metadata Resolver FilesystemMetadataResolver LocalMetadata: New metadata successfully loaded for 'C:\Program Files (x86)\Shibboleth\IdP\metadata\SPMetadata.xml'<br>2022-12-06 07:46:50,244 -  - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:396] - Metadata Resolver FilesystemMetadataResolver LocalMetadata: Next refresh cycle for metadata provider 'C:\Program Files (x86)\Shibboleth\IdP\metadata\SPMetadata.xml' will occur on '2022-12-06T18:46:50.186484700Z' ('2022-12-06T10:46:50.186484700-08:00[America/Los_Angeles]' local time)<br>2022-12-06 07:46:50,260 -  - INFO [net.shibboleth.idp.profile.spring.relyingparty.metadata.MetadataProviderContainer:96] - Top level Metadata Provider 'ShibbolethMetadata' did not have a sort key; giving it value '1'<br>2022-12-06 07:46:50,260 -  - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:421] - Service 'shibboleth.MetadataResolverService': Completed reload and swapped in latest configuration for service 'shibboleth.MetadataResolverService'<br>2022-12-06 07:46:50,260 -  - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:428] - Service 'shibboleth.MetadataResolverService': Reload complete<br>2022-12-06 07:46:50,400 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:173] - Service 'shibboleth.AttributeFilterService': Performing initial load<br>2022-12-06 07:46:50,400 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:259] - Service 'shibboleth.AttributeFilterService': Reloading service configuration<br>2022-12-06 07:46:50,572 -  - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:421] - Service 'shibboleth.AttributeFilterService': Completed reload and swapped in latest configuration for service 'shibboleth.AttributeFilterService'<br>2022-12-06 07:46:50,572 -  - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:428] - Service 'shibboleth.AttributeFilterService': Reload complete<br>2022-12-06 07:46:50,572 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:200] - Service 'shibboleth.AttributeFilterService': Reload interval set to: PT15M, starting refresh thread<br>2022-12-06 07:46:50,588 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:173] - Service 'shibboleth.AttributeResolverService': Performing initial load<br>2022-12-06 07:46:50,588 -  - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:259] - Service 'shibboleth.AttributeResolverService': Reloading service configuration<br>2022-12-06 07:46:50,603 -  - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] - Service 'shibboleth.AttributeResolverService': Initial load failed<br>net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanDefinitionStoreException: Missing 'name' attribute, cannot create transcoder rule<br>    at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)<br>Caused by: org.springframework.beans.factory.BeanDefinitionStoreException: Missing 'name' attribute, cannot create transcoder rule<br>   at net.shibboleth.idp.attribute.resolver.spring.enc.BaseSAML2AttributeEncoderParser.doParse(BaseSAML2AttributeEncoderParser.java:46)<br></div></div>