shibboleth 1.3 AttributeStatement missing when SubjectLocality.IpAddress is external (off campus IP)

[Michael Basil]

I have a setup where I am creating an SP with SimpleSAMLphp to an InCommon
IDP at Northwestern University (uses Shibboleth 1.3).

My SP does not support attribute query so the admin at NU set us up to use
attribute push.

Things work fine when the client (subject web browser not my SP) is on
campus, connected to NU WiFi, or on VPN.

However, when the client (subject web browser) is off campus the
AttributeStatement is not sent to my SP.

I realize that Shib 1.3 is not supported, but I was wondering if anyone
knew if there was a configuration setting we missed, something else subtle
going on, or a good place to start looking.

Thanks

Below are snippets of what my SP is receiving in each case.  I have
verified this behavior several different was (external servers, smart
phones, regular computers, etc.)

On campus assertion example - data pulled from SP log BEFORE parsing - raw
XML snippet:

  <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
AssertionID="_37893b574f4b02c7424f8f7dc4528dd7"
IssueInstant="2012-04-02T15:27:41.214Z" Issuer="urn:mace:incommon:
northwestern.edu" MajorVersion="1" MinorVersion="1">
    <Conditions NotBefore="2012-04-02T15:27:41.214Z"
NotOnOrAfter="2012-04-02T15:32:41.214Z">
      <AudienceRestrictionCondition>
        <Audience>
https://adeassodev.northwestern.edu/simplesaml/module.php/saml/sp/metadata.php/nu_passport
</Audience>
      </AudienceRestrictionCondition>
    </Conditions>
    <AuthenticationStatement
AuthenticationInstant="2012-04-02T15:27:41.214Z"
AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified">
      <Subject>
        <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier"
NameQualifier="urn:mace:incommon:northwestern.edu">XXX</NameIdentifier>
        <SubjectConfirmation>

<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod>
        </SubjectConfirmation>
      </Subject>
      <SubjectLocality IPAddress="129.105.233.157"/>
    </AuthenticationStatement>
    <AttributeStatement>
      <Subject>
        <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier"
NameQualifier="urn:mace:incommon:northwestern.edu">XXX</NameIdentifier>
        <SubjectConfirmation>

<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod>
        </SubjectConfirmation>
      </Subject>
      <Attribute xmlns:typens="urn:mace:shibboleth:1.0"
AttributeName="urn:mace:dir:attribute-def:uid"
AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri">
        <AttributeValue
xsi:type="typens:AttributeValueType">mby076</AttributeValue>
      </Attribute>
      <Attribute xmlns:typens="urn:mace:shibboleth:1.0"
AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri">
        <AttributeValue Scope="northwestern.edu"
xsi:type="typens:AttributeValueType">mby076</AttributeValue>
      </Attribute>
    </AttributeStatement>
  </Assertion>

Off campus assertion (missing AttributeStatement) - data pulled from SP log
BEFORE parsing - raw XML snippet:

  <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
AssertionID="_62c0e0368a6da881a94eb2f113feb8da"
IssueInstant="2012-04-02T15:33:03.668Z" Issuer="urn:mace:incommon:
northwestern.edu" MajorVersion="1" MinorVersion="1">
    <Conditions NotBefore="2012-04-02T15:33:03.668Z"
NotOnOrAfter="2012-04-02T15:38:03.668Z">
      <AudienceRestrictionCondition>
        <Audience>
https://adeassodev.northwestern.edu/simplesaml/module.php/saml/sp/metadata.php/nu_passport
</Audience>
        <Audience>urn:mace:incommon</Audience>
      </AudienceRestrictionCondition>
    </Conditions>
    <AuthenticationStatement
AuthenticationInstant="2012-04-02T15:33:03.668Z"
AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified">
      <Subject>
        <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier"
NameQualifier="urn:mace:incommon:northwestern.edu">XXX</NameIdentifier>
        <SubjectConfirmation>

<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod>
        </SubjectConfirmation>
      </Subject>
      <SubjectLocality IPAddress="209.114.43.98"/>
    </AuthenticationStatement>
  </Assertion>

Mike Basil
312.961.7798
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120402/0b1b1650/attachment.html