shibboleth 1.3 AttributeStatement missing when SubjectLocality.IpAddress is external (off campus IP)

[Cantor, Scott]

> We are using browser post.  The URL that is generating the SAML 1 request
> looks identical minus a state ID (noted below) ... so I don't think it is a
> corrupted request.  The request lengths are less than 600 characters too, so
> there isn't anything like that in play.

Doesn't seem to be.

> Plus, the assertion states the Audience correctly in both cases.

No chance of this happening then, so...no idea. Time to start tracing code and logs.
 
> Could there be Attribute Release Policies in play (that I should have the
> admin check)?

No, policies in 1.3 know nothing about the location of the client.

-- Scott