sp trying to contact the idp directly

[Cantor, Scott]

On 9/22/15, 3:46 PM, "users on behalf of Jeremy Shapiro" <users-bounces at shibboleth.net on behalf of jnshapiro at gmail.com> wrote:
>
>On newly authenticated requests the shibd daemon is trying to contact the IdP directly.  What in my config could be causing this?

The default AttributeResolver plugin of type="Query" combined with the fact that the IdP released no attributes to the SP.

>All of our attributes should be resolved in the response from the idp to the sp.  

There are no attributes in that response.

If you don't support queries, stop supplying metadata to the SP saying you do. That would be the fundamental mistake, but it won't change the overall result.

-- Scott