Shib IdP 3 and IOP online service

[Maja Wolniewicz]

W dniu 26.03.2015 o 08:53, Rod Widdowson pisze:
>>> The default is to not push attributes, but users are still prompted
>>> for consent (because they can't be prompted during back-channel
>>> attribute query).
>>>
>>> Hope this helps.
>> Yes, thanks for help.
> I'd be interested in the result of this experiment.  It seems as though something dodgy is up since you report that no attributes were actually released to the SP even though you accepted them.
>
> At the same time I have seen attributes release to a SAML1 SP using attribute pull, so there is something weird either about the SP or your configuration.
>
> Would it be useful if I dug out some other logging classes to help diagnose this flow?
Unfortunately I can't confirm that with 
p:includeAttributeStatement="true" it would work because in the meantime
we removed  SAML1 endpoints from our Shib 3 IdP metadata (because our 
production SSP IdP handles only SAML2 and we never offered SAML1 
endpoints before) and on the next day IOP online started to go through 
SAML2 endpoint.
So the first observation is that IOP online service prefers SAML1 
endpoints which isn't the best choice,  I think.
To summarize - my experience showed that when the per-attribute consent 
is active the consent page is skipped although there are attributes to 
present.
After switching off the per-attribute consent the consent page was 
showed but accepted attributes where not included in the response and 
they were not placed in the consent storage.
Switching off consent for this site didn't help as well.
Probably adding p:includeAttributeStatement="true" pointed by Tom would 
help, but anyway when the consent for a SAM1 SP has to be presented the 
per-attribute consent must be deactivated for all sites which may be 
annoying.

Maja



>
> Rod
>
>

-- 
Maja Gorecka-Wolniewicz          mgw at umk.pl
Uczelniane Centrum               Information & Communication
Informatyczne                    Technology Centre
Uniwersytet Mikolaja Kopernika   Nicolaus Copernicus University
Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland
tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5278 bytes
Desc: Kryptograficzna sygnatura S/MIME
Url : http://shibboleth.net/pipermail/users/attachments/20150326/63a79648/attachment-0001.bin