<div dir="ltr">Ok re-working it. No need to change NameID to persistent. Just want to send them this opaque attribute identifier.<div><br></div><div>When I added Dave's lines to my attribute-resolver.xml it's bombing out on starting</div><div><br></div><div><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing; - []2023-01-11 16:47:16,987 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] - Service 'shibboleth.AttributeRegistryService': Initial load failed</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing;net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 210 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber: 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character [children], because the type's content type is element-only.</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing;<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing;Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 210 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber: 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character [children], because the type's content type is element-only.</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing;<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:402)</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing;Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character [children], because the type's content type is element-only.</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing;<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;2023-01-11 16:47:16,987 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] - Service 'shibboleth.AttributeRegistryService': Initial load failed</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 210 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber: 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character [children], because the type's content type is element-only.</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 210 in XML document from file [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber: 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character [children], because the type's content type is element-only.</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:402)</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character [children], because the type's content type is element-only.</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-warn.log;dev;nothing;<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)</span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">shib-idp;idp-process.log;dev;nothing; - []2023-01-11 16:47:16,995 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:185] - Service 'shibboleth.AttributeRegistryService': No further attempts will be made to reload</span></p></div><div><br></div><div>Line 210 is:</div><div><br></div><div><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">206: <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"></span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">207: <InputDataConnector ref="computedID" attributeNames="computedID" /></span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">208: <AttributeEncoder xsi:type="SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /></span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">209: <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" /></span></p>
<p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures">210: </AttributeDefinition></span></p></div><div><br></div><div>I did fix my data connector for my attribute, and changed the salt to random characters</div><div><br></div><div><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(232,235,20)">318 </span><span style="font-variant-ligatures:no-common-ligatures"> <DataConnector xsi:type="ComputedId"</span></p><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(232,235,20)">319 </span><span style="font-variant-ligatures:no-common-ligatures"> id="computedID"</span></p><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(232,235,20)">320 </span><span style="font-variant-ligatures:no-common-ligatures"> generatedAttributeID="computedID"</span></p><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(232,235,20)">321 </span><span style="font-variant-ligatures:no-common-ligatures"> salt="Some Random Characters"> </span></p><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(232,235,20)">322 </span><span style="font-variant-ligatures:no-common-ligatures"> <InputDataConnector ref="myLDAP" attributeNames="uid" /></span></p><p style="margin:0px;font-stretch:normal;font-size:12px;line-height:normal;font-family:"Andale Mono";color:rgb(47,255,18);background-color:rgba(0,0,0,0.9)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(232,235,20)">323 </span><span style="font-variant-ligatures:no-common-ligatures"> </DataConnector></span></p></div><div><br></div><div>Any ideas what's going on here?</div><div><br></div><div>Thanks</div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:14px;background-color:rgb(255,255,255)"><font color="#006600" face="georgia, serif"><b>Melvin Lasky</b></font><div><font color="#006600" face="georgia, serif"><i>Associate Director of Enterprise Architecture</i></font></div><div><font face="georgia, serif"><img src="http://home.manhattan.edu/collegerelations/email_logo.jpg"><br></font></div><div><font face="georgia, serif">Riverdale, NY 10471</font></div><div><font face="georgia, serif">Phone: 718-862-7410</font></div><div><a href="mailto:melvin.lasky@manhattan.edu" style="font-family:georgia,serif;color:rgb(6,88,181)" target="_blank">melvin.lasky@manhattan.edu</a><br></div><div><font color="#006600" face="georgia, serif"><a href="http://www.manhattan.edu/" style="color:rgb(6,88,181)" target="_blank">www.manhattan.edu</a></font></div><div><br></div></span></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 11, 2023 at 11:45 AM Cantor, Scott via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">> Regarding the SP metadata, you MAY have to delete the "unspecified" line. My<br>
> IdP tends to resolve to whatever it wants when "unspecified" is in the SP<br>
> metadata.<br>
<br>
That would only happen if you explicitly configured support for it in your IdP, otherwise we ignore it (and we definitely ignore it when an SP requests it explicitly).<br>
<br>
This is one of those "don't support this, ever" things that I tell people and they frequently just aren't willing to push back or understand that when vendors say they want that, they don't mean it (and don't care if you use it or not).<br>
<br>
I can think of maybe 1-2 non-Shib SP cases I've ever seen where an SP even checks or notices the Format of a NameID, just one of thoese completely broken things that became common because people are lazy (and lazy -> broken when you support security specs).<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>