No attributes released to SAML1 requests

[Peter Schober]

* Andrew Chiarello <achiarello at brynmawr.edu> [2015-07-20 17:29]:
> To be more specific, when in my idp-audit log I see a request
> containing urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding, no
> attributes are included, whereas when the equivalent field says
> urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST , they are released
> correctly.

By default the Shib IDP does not push (HTTP POST) attributes over the
web browser when accessing services via SAML1.
In such cases the SAML SP either has to /ask/ for attributes in an
attribute query (the SOAP binding above) after recieving the HTTP
POST, or you change your configuration of your IDP to "push"
attributes unencrypted with the HTTP POST to the SP.

If using the default (no attributes in HTTP POST with SAML1) there are
two main reasons why a SAML1 SP might not get any attributes:
1. The attribute query failes, most commonly due to a misconfigured
   TCP port / web server for SOAP requests.
2. You did not instruct the IDP to release attributes to that SP.

-peter