shibboleth 1.3 AttributeStatement missing when SubjectLocality.IpAddress is external (off campus IP)

[Michael Basil]

We are using browser post.  The URL that is generating the SAML 1 request
looks identical minus a state ID (noted below) ... so I don't think it is a
corrupted request.  The request lengths are less than 600 characters too,
so there isn't anything like that in play.

Plus, the assertion states the Audience correctly in both cases.

Could there be Attribute Release Policies in play (that I should have the
admin check)?

good:

https://fed.it.northwestern.edu/shibboleth-idp/SSO?providerId=https%3A%2F%2Fadeassodev.northwestern.edu%2Fsimplesaml%2Fmodule.php%2Fsaml%2Fsp%2Fmetadata.php%2Fnu_passport&shire=https%3A%2F%2Fadeassodev.northwestern.edu%2Fsimplesaml%2Fmodule.php%2Fsaml%2Fsp%2Fsaml1-acs.php%2Fnu_passport&target=
_79ae1cd2ef1fe78afc1c9daa3e363f65c7df4c6cfd%3Ahttps%3A%2F%
2Fadeassodev.northwestern.edu
%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dnu_passport%26ReturnTo%3Dhttps%253A%252F%
252Fadeassodev.northwestern.edu
%252Fsimplesaml%252Fmodule.php%252Fcore%252Fauthenticate.php%253Fas%253Dnu_passport

bad:

https://fed.it.northwestern.edu/shibboleth-idp/SSO?providerId=https%3A%2F%2Fadeassodev.northwestern.edu%2Fsimplesaml%2Fmodule.php%2Fsaml%2Fsp%2Fmetadata.php%2Fnu_passport&shire=https%3A%2F%2Fadeassodev.northwestern.edu%2Fsimplesaml%2Fmodule.php%2Fsaml%2Fsp%2Fsaml1-acs.php%2Fnu_passport&target=
_7e6a2ae72b065cb1ed894c2500322d12b6ed0a0ff8%3Ahttps%3A%2F%
2Fadeassodev.northwestern.edu
%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dnu_passport%26ReturnTo%3Dhttps%253A%252F%
252Fadeassodev.northwestern.edu
%252Fsimplesaml%252Fmodule.php%252Fcore%252Fauthenticate.php%253Fas%253Dnu_passport

Mike Basil
312.961.7798


On Mon, Apr 2, 2012 at 15:09, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > However, when the client (subject web browser) is off campus the
> > AttributeStatement is not sent to my SP.
>
> There's nothing that could cause that unless the difference is resulting
> in a corrupted request that doesn't actually identify the SP (or
> misidentifies it) and results in some default behavior.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120402/bcad96ed/attachment.html