SAML2 Attribute Query Failing

[Peter Schober]

* Juan Quintanilla <jquin014 at fiu.edu> [2012-06-11 21:49]:
> After authentication with the new service provider we see that no
> attributes are released, the error message the admin of the service
> provider gave us is
[...]
> > CURLSOAPTransport failed while contacting SOAP endpoint
> > (https://authfed.fiu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery):
> > couldn't connect to host
    ^^^^^^^^^^^^^^^^^^^^^^^^

I think you already fixed that. Also since this is SAML2 the only
reason the SP is querying is because you didn't send any attributes in
the first place. So by fixing your release policy filter you also
avoid any further attribtue queries from that SP.

But of course you either should have working endpoints in metadata, or
remove them (i.e., for attribute queries) and close the firewall again.

>20120611T183617Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_87853969cb3681e9897bf8a6da613477|https://corp.collegenet.com/shibboleth-sp/|urn:mace:shibboleth:2.0:profiles:saml2:query:attribute|https://authfed.fiu.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_363c828d29c131d01fa04d605feea6bd|jdoe011|||||

That's not the same entityId as in your config:

>         <afp:PolicyRequirementRule
>         xsi:type="basic:AttributeRequesterString"
>         value="https://corp.collegenet.com/shibboleth-sp"/>

There is no canonicalization happening here, it's kust an exact string
match,
-peter