IDPv3.1.2: SAML2 AttributeQuery processing fails with Message context was not authenticated

[Cantor, Scott]

On 9/13/15, 4:39 PM, "users on behalf of Guenther Schreiner" <users-bounces at shibboleth.net on behalf of Guenther.Schreiner at hs-karlsruhe.de> wrote:

>whereas our configuration for SAML1 works well avoiding an AttributeQuery
> with the includeAttributeStatement, the SAML2 processing fails during the
> AttributeQuery with
> >> WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
> >> org.opensaml.messaging.handler.MessageHandlerException: Message context was not authenticated 
> 
> Any idea to avoid this situation?

If the error is logged from an attribute query, the basic answer is that you don't have the backchannel configured correctly or the request is simply being made incorrectly and is in fact invalid (wrong key, whatever). If you don't support attribute queries, you shouldn't have metadata indicating you do, and you then wouldn't be getting any queries at all. I can't tell if that's what you want or not.

If you're asking why it's receiving a query, it's because you didn't supply any attributes to the SP (and you claim you support queries in your metadata).

If you're asking why a SAML 1 response includes attribute(s) but a SAML 2 response didn't, that would normally have to be caused by an issue with attribute encoders. Whatever you released has SAML 1 encoders but not SAML 2 encoders attached in the resolver.

-- Scott