IdP v3 not releasing attributes to SAML1 SPs

[Mark K. Miller]

On Mon, 22 Aug 2016, Cantor, Scott wrote:

>> Just to be sure you keep the right perspective, I'm just clueless, not
>> being arguementative!  And, to prove it...  "Same as before?"  What did I
>> do before to push them?

Ok, this crisis is now past, and I've taken a deep breath.  And, to close 
the loop on this one; first, again Scott, thank you so much for your help!

> I don't know, and would seriously doubt, that you did push them or it 
> wouldn't be broken now.

In case anyone ever wonders...  Yes, Scott was absolutely correct again.

> If you can't fix the back channel and you don't care about the 
> sensitivity of the data you're sending, and you want a quick fix for 
> most of the broken services, you can set the includeAttributeStatement 
> profile flag in the profile configuration for SAML 1 (Shibboleth) SSO.

Yup, that's the quick fix!  And, searching the wiki for 
"includeAttributeStatement" took me straight to entries that even I could 
understand what to do!

>> So, if it's all identical, just the same, then why would you need to make
>> this change?
>
> I didn't need to; I wanted to get rid of the back channel, and I only 
> had a small number of SPs left, so I just dumped it and switched the 
> behavior when I upgraded.

Ah, I see.

>> What does it take to deliberately turn off SAML1 queries?
>
> Pushing attributes,

Ok, check!

>                     disabling the query profile,

Ah!  You mean getting rid of this kind of thing:
                 <ref bean="SAML1.AttributeQuery" />

>                                                  not offering a second 
> port,

Is this tomcat and/or apache?  Or, is it really an IdP config change?

>       and changing my metadata.
>
>> Would I simply stop advertising an ArtifactResolutionService endpoint 
>> for a SAML1 SOAP binding in my metadata?
>
> I didn't say anything about artifact support. I never supported 
> artifacts, so that wasn't a change for me. I'm talking about queries. 
> Queries are not artifact resolution requests. They're both SOAP.

Sorry, my bad!  Crisis mode; I was trying to 'speed read' the metadata. 
That didn't turn out well.

You're really talking about removing this endpoint:

     <AttributeService 
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" 
Location="https://as1.fim.psu.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery"/


>> Or, is there more to it than that?  Is there some
>> IdP config file that also needs changed?
>
> Changing the metadata is the first thing to do once you're done 
> supporting something, and turning off the profile in the IdP would be 
> last.

Understood!

> --Scott

Thanks for putting up with me, and, again, thanks for the help!

Max