RequestedAttributes in SP metada

[Ian Young]

On 24 Dec 2013, at 20:45, Nick Amon <namon at xceedium.com> wrote:

> After successful authentication, I noticed this in the logs:
> 20:20:51.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal XXX were not requested, resolving all attributes.
>  
> As if the AttributeResolver did not recognize that the SP’s RequestedAttribute.

That's not what the message means.

"Specific attributes ... were not requested" means that the authentication request from the SP does not contain a list of attributes. This is normal, which is why the message is only at DEBUG level. It's not an error.

The consequence is that the IdP will resolve all attributes it is configured for, and then filter them according to the configured attribute release policy. Again, this is normal behaviour. You control the attributes you want the IdP to release to a given SP by changing the policy, not in general by changing the metadata.

	-- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131226/bb744ed4/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5943 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20131226/bb744ed4/attachment.bin