title: Ansible xml add a new attribute when trying to modify the value of an existing one
body: <p>The original xml part is:</p>
  
  <pre><code>&lt;ApplicationDefaults
    entityID="https://sp.example.org/shibboleth"
    REMOTE_USER="eppn subject-id pairwise-id persistent-id"
    cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"&gt;
  </code></pre>
  
  <p>Then I  tried to modify the value of <strong>entityID</strong> with ansible:
  <a href="https://docs.ansible.com/ansible/latest/modules/xml_module.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/modules/xml_module.html</a></p>
  
  <pre><code>- xml:
      namespaces:
        ns: "urn:mace:shibboleth:3.0:native:sp:config"
      path: shibboleth2.xml
      xpath: '/ns:SPConfig/ns:ApplicationDefaults'
      attribute: "ns:entityID"
      value: "my_url/shibboleth"
  </code></pre>
  
  <p>Instead of modifying <strong>entityID</strong> it creates <strong>conf:entityID</strong></p>
  
  <pre><code>&lt;ApplicationDefaults
    entityID="https://sp.example.org/shibboleth"
    REMOTE_USER="eppn subject-id pairwise-id persistent-id"
   cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"
    conf:entityID="my_url/shibboleth"&gt;
  </code></pre>
  
  <p>Below is the full XML file. I suppose it is because of the <strong>xmlns:conf</strong> defined at the root node, but I don't understand XML/Xpath enough to know how to fix that behavior. And my researches so far were not successfull.</p>
  
  <pre><code>&lt;SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
      xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
      clockSkew="180"&gt;
  
      &lt;OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" /&gt;
  
      &lt;!--
               By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
      are used. See example-shibboleth2.xml for samples of explicitly configuring them.
      --&gt;
  
      &lt;!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. --&gt;
      &lt;ApplicationDefaults entityID="https://sp.example.org/shibboleth"
          REMOTE_USER="eppn subject-id pairwise-id persistent-id"
          cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"&gt;
  
          &lt;!--
                       Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
          Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
          and should be a relative path, with the SP computing the full value based on the virtual
          host. Using handlerSSL="true" will force the protocol to be https. You should also set
          cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
          "false", this makes an assertion stolen in transit easier for attackers to misuse.
          --&gt;
          &lt;Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                    checkAddress="false" handlerSSL="false" cookieProps="http"&gt;
  
              &lt;!--
                               Configures SSO for a default IdP. To properly allow for &gt;1 IdP, remove
              entityID property and adjust discoveryURL to point to discovery service.
              You can also override entityID on /Login query string, or in RequestMap/htaccess.
              --&gt;
              &lt;SSO entityID="https://idp.example.org/idp/shibboleth"
                   discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF"&gt;
                SAML2
              &lt;/SSO&gt;
  
              &lt;!-- SAML and local-only logout. --&gt;
              &lt;Logout&gt;SAML2 Local&lt;/Logout&gt;
  
              &lt;!-- Administrative logout. --&gt;
              &lt;LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" /&gt;
  
              &lt;!-- Extension service that generates "approximate" metadata based on SP configuration. --&gt;
              &lt;Handler type="MetadataGenerator" Location="/Metadata" signing="false"/&gt;
  
              &lt;!-- Status reporting service. --&gt;
              &lt;Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/&gt;
  
              &lt;!-- Session diagnostic service. --&gt;
              &lt;Handler type="Session" Location="/Session" showAttributeValues="false"/&gt;
  
              &lt;!-- JSON feed of discovery information. --&gt;
              &lt;Handler type="DiscoveryFeed" Location="/DiscoFeed"/&gt;
          &lt;/Sessions&gt;
  
          &lt;!--
                       Allows overriding of error template information/filenames. You can
          also add your own attributes with values that can be plugged into the
          templates, e.g., helpLocation below.
          --&gt;
          &lt;Errors supportContact="root@localhost"
              helpLocation="/about.html"
              styleSheet="/shibboleth-sp/main.css"/&gt;
  
          &lt;!-- Example of locally maintained metadata. --&gt;
          &lt;!--
                       &lt;MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/&gt;
          --&gt;
  
          &lt;!-- Example of remotely supplied batch of signed metadata. --&gt;
          &lt;!--
                       &lt;MetadataProvider type="XML" validate="true"
                      url="http://federation.org/federation-metadata.xml"
                backingFilePath="federation-metadata.xml" maxRefreshDelay="7200"&gt;
              &lt;MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/&gt;
              &lt;MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/&gt;
              &lt;DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
                attributeName="http://macedir.org/entity-category"
                attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                attributeValue="http://refeds.org/category/hide-from-discovery" /&gt;
          &lt;/MetadataProvider&gt;
          --&gt;
  
          &lt;!-- Example of remotely supplied "on-demand" signed metadata. --&gt;
          &lt;!--
                       &lt;MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
                      baseUrl="http://mdq.federation.org" ignoreTransport="true"&gt;
              &lt;MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/&gt;
              &lt;MetadataFilter type="Signature" certificate="mdqsigner.pem" /&gt;
          &lt;/MetadataProvider&gt;
          --&gt;
  
          &lt;!-- Map to extract attributes from SAML assertions. --&gt;
          &lt;AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/&gt;
  
          &lt;!-- Default filtering policy for recognized attributes, lets other data pass. --&gt;
          &lt;AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/&gt;
  
          &lt;!-- Simple file-based resolvers for separate signing/encryption keys. --&gt;
          &lt;CredentialResolver type="File" use="signing"
              key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/&gt;
          &lt;CredentialResolver type="File" use="encryption"
              key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/&gt;
  
      &lt;/ApplicationDefaults&gt;
  
      &lt;!-- Policies that determine how to process and authenticate runtime messages. --&gt;
      &lt;SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/&gt;
  
      &lt;!-- Low-level configuration about protocols and bindings available for use. --&gt;
      &lt;ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/&gt;
  
  &lt;/SPConfig&gt;
  </code></pre>