Nagging error: 'unable to extract attributes, unknown XML object type: saml2p:Response'

[Peter Schober]

* Paul Wilt <pewilt at gmail.com> [2016-12-02 16:41]:
> I was attributing these DEBUG messages to indicate that something
> prevented the attribute extraction from happening.

The quotes message literally means just that: That the XML element
referenced is not *itself* something that contains attributes,
basically. The Reponse element will likely contain an XML child
element (an Assertion) and that will likely contain another child
element (an AttributeStatment) and that will likely contain another
child element (an Attribute element) and /there/ might be an attribute
the code will be able to extract.

So this is not indicative of a problem, you're merely watching the
code at work, going over *unrelated* parts of XML.

The transaction.log on the other hand *will* give you the list of
attributes the SP could find and decode, and you don't need DEBUB
logging for that either, the default settings will suffice. E.g.:

2016-12-02 11:08:20 INFO Shibboleth-TRANSACTION [15]: Cached the following attributes with session (ID: _123) for (applicationId: default) {
2016-12-02 11:08:20 INFO Shibboleth-TRANSACTION [15]:   eppn (1 values)
2016-12-02 11:08:20 INFO Shibboleth-TRANSACTION [15]:   transient-id (1 values)
2016-12-02 11:08:20 INFO Shibboleth-TRANSACTION [15]: }

With no attributes recived that would simply look like this:

2016-12-02 11:08:20 INFO Shibboleth-TRANSACTION [15]: Cached the following attributes with session (ID: _123) for (applicationId: default) {
2016-12-02 11:08:20 INFO Shibboleth-TRANSACTION [15]: }

and with recent software you can also configure the log format to
suite your needs, e.g. into a format where you don't have to
parse/match multiple log lines.

You'll find attributes sent by the IDP but not mapped by your SP by
looking for lines like these in shibd.log:

2016-12-02 06:54:26 INFO Shibboleth.AttributeExtractor.XML [13]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:1.3.6.1.4.1.25178.1.0.2.3

And you always have shibd_warn.log to look for warnings and errors,
avoiding confusion from logging everything and finding nothing.
-peter