SAML2 Attribute Query Failing

[Juan Quintanilla]

Hi,

We are trying to setup communication with a new service provider from our idp, their information was added to the relying-party.xml, attribute-filter.xml and we have obtained their metadata.

After authentication with the new service provider we see that no attributes are released, the error message the admin of the service provider gave us is

> 2012-06-06 08:52:19 ERROR Shibboleth.AttributeResolver.Query [1959]: exception during SAML query to https://authfed.fiu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery: CURLSOAPTransport failed while contacting SOAP endpoint (https://authfed.fiu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery): couldn't connect to host
> 2012-06-06 08:52:19 ERROR Shibboleth.AttributeResolver.Query [1959]: unable to obtain a SAML response from attribute authority

On our idp-process.log we see the following:

14:36:17.672 - INFO [Shibboleth-Access:74] - 20120611T183617Z|74.122.104.103|authfed.fiu.edu:8443|/profile/SAML2/SOAP/AttributeQuery|
14:36:17.810 - INFO [Shibboleth-Audit:989] - 20120611T183617Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_87853969cb3681e9897bf8a6da613477|https://corp.collegenet.com/shibboleth-sp/|urn:mace:shibboleth:2.0:profiles:saml2:query:attribute|https://authfed.fiu.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_363c828d29c131d01fa04d605feea6bd|jdoe011|||||



We have opened up our firewall rules to the ips mentioned by the service provider but we still encounter this problem.  We have previously configured other sp's with no problem.

Has anybody else encountered this problem.  If so any help would be much appreciated.

Thanks!

Here is our attribute-filter.xml file

<afp:AttributeFilterPolicy id="collegenetdev">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://corp.collegenet.com/shibboleth-sp"/>
           <afp:AttributeRule attributeID="uid">
              <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="firstName">
              <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="lastName">
              <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="email">
              <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="employeeType">
              <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
     </afp:AttributeFilterPolicy>



___________________
Juan Quintanilla
305-348-6573
jquin014 at fiu.edu<mailto:jquin014 at fiu.edu>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120611/8476e749/attachment-0001.html