Not releasing attributes to specific EntityID after IDP upgrade from 2.4 to 3.2

Rich Thomas rcthomas at utmb.edu
Fri Feb 19 17:28:20 EST 2016 

After migrating our IDP from 2.4 to 3.2, attributes are not being released
for the following filter.
Confirmed that attributes are still being released from 2.4 IDP.

<AttributeFilterPolicy id="releaseTo_NIH" >
        <PolicyRequirementRule xsi:type="OR">
               <Rule xsi:type="Requester"
value="https://federation.nih.gov/FederationGateway" />
               <Rule xsi:type="Requester"
value="https://soadev.nih.gov/FederationGateway" />
        </PolicyRequirementRule>
           <AttributeRule
attributeID="urn:oid:1.3.6.1.4.1.5923.1.1.1.6-with-inline-scope">
              <PermitValueRule xsi:type="ANY" />
           </AttributeRule>
           <AttributeRule attributeID="email">
              <PermitValueRule xsi:type="ANY" />
           </AttributeRule>
           <AttributeRule attributeID="surname">
              <PermitValueRule xsi:type="ANY" />
           </AttributeRule>
           <AttributeRule attributeID="givenName">
              <PermitValueRule xsi:type="ANY" />
           </AttributeRule>
    </AttributeFilterPolicy>

Debug output below.

2016-02-19 16:12:11,629 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:132] - Attribute
Filter Policy 'releaseTo_NIH'  Policy is active for this request
2016-02-19 16:12:11,629 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:159] - Attribute
Filter Policy 'releaseTo_NIH'  Applying attribute filter policy to current
set of attributes: [urn:oid:1.3.6.1.4.1.5923.1.1.1.6-with-inline-scope,
commonName, telephoneNumber, utPersonLocalID, organizationName, utmbUUID,
homePhone, givenName, eduPersonOrgDN, title, employeeNumber, utPersonBID,
uid, tdlUID, eduPersonPrimaryAffiliation, eduPersonScopedAffiliation,
utPersonEID, surname, HathiTrusteduPersonScopedAffiliation,
eduPersonPrincipalName, email]
2016-02-19 16:12:11,629 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:168] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_b2d3df7594af8404145f1f9fbff27f0c' 
Filtering values for attribute
'urn:oid:1.3.6.1.4.1.5923.1.1.1.6-with-inline-scope' which currently
contains 1 values
2016-02-19 16:12:11,629 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:177] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_b2d3df7594af8404145f1f9fbff27f0c' 
Filter has permitted the release of 1 values for attribute
'urn:oid:1.3.6.1.4.1.5923.1.1.1.6-with-inline-scope'
2016-02-19 16:12:11,645 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:168] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_85632e70eaa940a0af02b866aeed1a0b' 
Filtering values for attribute 'email' which currently contains 1 values
2016-02-19 16:12:11,645 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:177] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_85632e70eaa940a0af02b866aeed1a0b' 
Filter has permitted the release of 1 values for attribute 'email'
2016-02-19 16:12:11,645 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:168] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_ca48a03bbda9e3060ddee20b52965cb0' 
Filtering values for attribute 'surname' which currently contains 1 values
2016-02-19 16:12:11,645 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:177] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_ca48a03bbda9e3060ddee20b52965cb0' 
Filter has permitted the release of 1 values for attribute 'surname'
2016-02-19 16:12:11,645 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:168] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_62fd5abb4d399e5b2744eb241534041f' 
Filtering values for attribute 'givenName' which currently contains 1 values
2016-02-19 16:12:11,645 - DEBUG
[net.shibboleth.idp.attribute.filter.AttributeRule:177] - Attribute
filtering engine
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_62fd5abb4d399e5b2744eb241534041f' 
Filter has permitted the release of 1 values for attribute 'givenName'
2016-02-19 16:12:11,661 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] -
Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
attribute 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6-with-inline-scope' remained
after filtering
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute commonName values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute telephoneNumber values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute utPersonLocalID values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute organizationName values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute utmbUUID values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute homePhone values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] -
Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
attribute 'givenName' remained after filtering
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute eduPersonOrgDN values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute title values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute employeeNumber values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute utPersonBID values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute uid values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute tdlUID values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute eduPersonPrimaryAffiliation values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute eduPersonScopedAffiliation values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute utPersonEID values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] -
Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
attribute 'surname' remained after filtering
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute HathiTrusteduPersonScopedAffiliation values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:154] -
Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted
release of attribute eduPersonPrincipalName values
2016-02-19 16:12:11,676 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] -
Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
attribute 'email' remained after filtering
2016-02-19 16:12:11,708 - DEBUG
[org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:110] -
Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to
outgoing Response
2016-02-19 16:12:11,708 - DEBUG
[org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:189] -
Inbound binding urn:mace:shibboleth:1.0:profiles:AuthnRequest is suppressed,
ignoring request ID
2016-02-19 16:12:11,708 - DEBUG
[org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:121] -
Profile Action AddInResponseToToResponse: No request ID, nothing to do
2016-02-19 16:12:11,739 - DEBUG
[net.shibboleth.idp.saml.profile.impl.BaseAddAuthenticationStatementToAssertion:170]
- Profile Action AddAuthenticationStatementToAssertion: Attempting to add an
AuthenticationStatement to outgoing Assertion
2016-02-19 16:12:11,739 - DEBUG
[org.opensaml.saml.saml1.profile.SAML1ActionSupport:67] - Profile Action
AddAuthenticationStatementToAssertion: Created Assertion
_bcd0404f2c227c74f4e715e76dc36fe7
2016-02-19 16:12:11,739 - DEBUG
[org.opensaml.saml.saml1.profile.SAML1ActionSupport:91] - Profile Action
AddAuthenticationStatementToAssertion: Added Assertion
_bcd0404f2c227c74f4e715e76dc36fe7 to Response
_a1f2c7c0f9a92d2c343348258621d709
2016-02-19 16:12:11,739 - DEBUG
[net.shibboleth.idp.saml.saml1.profile.impl.AddAuthenticationStatementToAssertion:142]
- Profile Action AddAuthenticationStatementToAssertion: Added
AuthenticationStatement to Assertion _bcd0404f2c227c74f4e715e76dc36fe7
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddNameIdentifierToSubjects:171] -
Profile Action AddNameIdentifierToSubjects: Attempting to add NameIdentifier
to statements in outgoing Assertions
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
- Metadata specifies the following formats: []
2016-02-19 16:12:11,770 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100]
- Configuration specifies the following formats: []
2016-02-19 16:12:11,770 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:110]
- No formats specified in configuration or in metadata, returning default
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddNameIdentifierToSubjects:184] -
Profile Action AddNameIdentifierToSubjects: Candidate NameIdentifier
formats: [urn:mace:shibboleth:1.0:nameIdentifier]
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddNameIdentifierToSubjects:232] -
Profile Action AddNameIdentifierToSubjects: Trying to generate
NameIdentifier with Format urn:mace:shibboleth:1.0:nameIdentifier
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106]
- Trying to generate identifier with Format
urn:mace:shibboleth:1.0:nameIdentifier
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.AbstractSAML1NameIdentifierGenerator:68] -
Generating NameIdentifier
AAdzZWNyZXQxydF03GOYJ4DukdMvbBoMaga7B+47apReWRGWb1iFO2u+2eZo5jP2Wt8EZE9aeHw/+r5M+R3FnJaG6+ZzOHHNskqXc8HJIBbCPjT8svmgl70DT5N+X3767v6/3eBuNjUW7k2xH5wjt4ZdrqOA
with Format urn:mace:shibboleth:1.0:nameIdentifier
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:118]
- Successfully generated identifier with Format
urn:mace:shibboleth:1.0:nameIdentifier
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddNameIdentifierToSubjects:236] -
Profile Action AddNameIdentifierToSubjects: Successfully generated
NameIdentifier with Format urn:mace:shibboleth:1.0:nameIdentifier
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddNameIdentifierToSubjects:216] -
Profile Action AddNameIdentifierToSubjects: Added NameIdentifier to 1
statement subject(s)
2016-02-19 16:12:11,770 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddSubjectConfirmationToSubjects:165]
- Profile Action AddSubjectConfirmationToSubjects: Attempting to add
SubjectConfirmation to assertions in outgoing Response
2016-02-19 16:12:11,786 - DEBUG
[org.opensaml.saml.saml1.profile.impl.AddSubjectConfirmationToSubjects:218]
- Profile Action AddSubjectConfirmationToSubjects: Added SubjectConfirmation
with methods [urn:oasis:names:tc:SAML:1.0:cm:bearer] to 1 statement
subject(s)
2016-02-19 16:12:11,786 - DEBUG
[org.opensaml.saml.common.profile.impl.AddNotBeforeConditionToAssertions:79]
- Profile Action AddNotBeforeConditionToAssertions: Attempting to add
NotBefore condition to every Assertion in outgoing Response
2016-02-19 16:12:11,786 - DEBUG
[org.opensaml.saml.common.profile.impl.AddNotBeforeConditionToAssertions:114]
- Profile Action AddNotBeforeConditionToAssertions: Added NotBefore
condition to Assertion _bcd0404f2c227c74f4e715e76dc36fe7
2016-02-19 16:12:11,786 - DEBUG
[org.opensaml.saml.saml1.profile.SAML1ActionSupport:116] - Profile Action
AddNotBeforeConditionToAssertions: Assertion
_bcd0404f2c227c74f4e715e76dc36fe7 did not already contain Conditions, added
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:114]
- Profile Action AddNotOnOrAfterConditionToAssertions: Attempting to add
NotOnOrAfter condition to every Assertion in outgoing Response
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:159]
- Profile Action AddNotOnOrAfterConditionToAssertions: Added NotOnOrAfter
condition, indicating an expiration of 2016-02-19T22:17:11.692Z, to
Assertion _bcd0404f2c227c74f4e715e76dc36fe7
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.saml1.profile.SAML1ActionSupport:119] - Profile Action
AddNotOnOrAfterConditionToAssertions: Assertion
_bcd0404f2c227c74f4e715e76dc36fe7 already contains Conditions, nothing was
done
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:147]
- Profile Action AddAudienceRestrictionToAssertions: Attempting to add an
AudienceRestrictionCondition to every Assertion in Response
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.saml1.profile.SAML1ActionSupport:119] - Profile Action
AddAudienceRestrictionToAssertions: Assertion
_bcd0404f2c227c74f4e715e76dc36fe7 already contains Conditions, nothing was
done
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:262]
- Profile Action AddAudienceRestrictionToAssertions: Adding new
AudienceRestrictionCondition
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:214]
- Profile Action AddAudienceRestrictionToAssertions: Adding
https://federation.nih.gov/FederationGateway as an Audience of the
AudienceRestrictionCondition
2016-02-19 16:12:11,801 - DEBUG
[org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:185]
- Profile Action AddAudienceRestrictionToAssertions: Added
AudienceRestrictionCondition to Assertion _bcd0404f2c227c74f4e715e76dc36fe7
2016-02-19 16:12:11,817 - DEBUG
[org.opensaml.saml.common.profile.impl.SignAssertions:142] - Profile Action
SignAssertions: Will not sign assertions because no security parameters
context is available
2016-02-19 16:12:11,973 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:159] - Profile
Action WebFlowMessageHandlerAdaptor: Invoking message handler of type
'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND
message context
2016-02-19 16:12:11,973 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile
Action WebFlowMessageHandlerAdaptor: Invoking message handler on message
context containing a message of type
'org.opensaml.saml.saml1.core.impl.ResponseImpl'
2016-02-19 16:12:11,973 - DEBUG
[org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:58] -
Adding recipient to outbound SAML 1 protocol message:
https://itrusteauth.nih.gov/affwebservices/public/samlcc
2016-02-19 16:12:11,973 - DEBUG
[org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52]
- Message Handler:  Checking outbound endpoint for allowed URL scheme:
https://itrusteauth.nih.gov/affwebservices/public/samlcc
2016-02-19 16:12:11,989 - DEBUG
[org.opensaml.saml.common.SAMLObjectSupport:56] - Examing signed object for
content references with exclusive canonicalization transform
2016-02-19 16:12:11,989 - DEBUG
[org.opensaml.saml.common.SAMLObjectSupport:70] - Saw exclusive transform,
declaring non-visible namespaces on signed object
2016-02-19 16:12:11,989 - DEBUG
[org.opensaml.saml.common.SAMLObjectContentReference:165] - Adding list of
inclusive namespaces for signature exclusive canonicalization transform
2016-02-19 16:12:12,020 - DEBUG
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
- Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:1.0:profiles:browser-post
2016-02-19 16:12:12,036 - DEBUG
[org.opensaml.saml.saml1.binding.encoding.impl.HTTPPostEncoder:156] -
Invoking velocity template to create POST body
2016-02-19 16:12:12,036 - DEBUG
[org.opensaml.saml.saml1.binding.encoding.impl.HTTPPostEncoder:163] -
Encoding action url of
'https://itrusteauth.nih.gov/affwebservices/public/samlcc' with encoded
value
'https&#x3a;&#x2f;&#x2f;itrusteauth.nih.gov&#x2f;affwebservices&#x2f;public&#x2f;samlcc'
2016-02-19 16:12:12,036 - DEBUG
[org.opensaml.saml.saml1.binding.encoding.impl.HTTPPostEncoder:167] -
Marshalling and Base64 encoding SAML message
2016-02-19 16:12:12,036 - DEBUG
[org.opensaml.saml.saml1.binding.encoding.impl.HTTPPostEncoder:175] -
Setting TARGET parameter to:
'https://itrusteauth.nih.gov/FederationPortal/Portal.asp?TARGET=https://federation.nih.gov/ncbifedauth/cit.cgi%3Fcmd%3Dlogin%26version%3D2%26auth%3Duniversity_of_texas_medical_branch_at_galveston%26url%3D68747470733A2F2F7777772E6E6362692E6E6C6D2E6E69682E676F762F6C6F67696E2F64697370617463682F64697370617463682E6367693F636D643D72657475726E2672657475726E3D6C696E6B2675726C3D4036383734373437303733334132463246373737373737324536453633363236393245364536433644324536453639363832453637364637363246373036463732373436313643324637333639363736453639364532453636363336373639334636413733323636333644363433443445363336323639364337333532363537333646364337363635',
encoded as
'https&#x3a;&#x2f;&#x2f;itrusteauth.nih.gov&#x2f;FederationPortal&#x2f;Portal.asp&#x3f;TARGET&#x3d;https&#x3a;&#x2f;&#x2f;federation.nih.gov&#x2f;ncbifedauth&#x2f;cit.cgi&#x25;3Fcmd&#x25;3Dlogin&#x25;26version&#x25;3D2&#x25;26auth&#x25;3Duniversity_of_texas_medical_branch_at_galveston&#x25;26url&#x25;3D68747470733A2F2F7777772E6E6362692E6E6C6D2E6E69682E676F762F6C6F67696E2F64697370617463682F64697370617463682E6367693F636D643D72657475726E2672657475726E3D6C696E6B2675726C3D4036383734373437303733334132463246373737373737324536453633363236393245364536433644324536453639363832453637364637363246373036463732373436313643324637333639363736453639364532453636363336373639334636413733323636333644363433443445363336323639364337333532363537333646364337363635'
2016-02-19 16:12:12,051 - DEBUG [PROTOCOL_MESSAGE:70] - 
<?xml version="1.0" encoding="UTF-8"?>
<saml1p:Response IssueInstant="2016-02-19T22:12:11.692Z"
    MajorVersion="1" MinorVersion="1"
    Recipient="https://itrusteauth.nih.gov/affwebservices/public/samlcc"
    ResponseID="_a1f2c7c0f9a92d2c343348258621d709"
xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol">
    <ds:Signature
                xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
                Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
               
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference
                        URI="#_a1f2c7c0f9a92d2c343348258621d709">
<ds:Transforms>
<ds:Transform
                       
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform
                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>8TaZL85x8wlqO6gg4RcEZ8TjcP+1d1r8rvy8ywoE0JU=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
k0GUVVEbj8yUJuF1+ZVQRAxIc2o2cdDTVgveViyUiPzoc5isM3OyM0yLNo1EF7GH3eO078vNRpq6
V/eQKPM6PJNA2uHMltWRs+WQnIslT9pQsAOaxMajNk02glwBORtgfbvfBsr42W/xyWxL7PeHYyXH
p65O5vUIakpuRvvfeeFSE00Xx33B1KzWwv2oARe30XXrkyEvaGD4NshNElr2Es9nGqste1A6BubI
OmX6ESTBUXYlkOlsvJS6wYuvvwG27Pe9MBdGmbP1/tnYWCmzazuhUbQ8sohc/2zHoEjdQnAVEErG
iYD8foPIB3g2OGGly4D1bNFX+YVriuHYQgzAuw==
</ds:SignatureValue>
<ds:KeyInfo>
            <ds:X509Data>
               
<ds:X509Certificate>MIIEgzCCA2ugAwIBAgIJANpT3JDpg2sAMA0GCSqGSIb3DQEBBQUAMIGHMQswCQYDVQQGEwJVUzEO
MAwGA1UECBMFVGV4YXMxEjAQBgNVBAcTCUdhbHZlc3RvbjENMAsGA1UEChMEVVRNQjELMAkGA1UE
CxMCSVMxFTATBgNVBAMTDGlkcC51dG1iLmVkdTEhMB8GCSqGSIb3DQEJARYSaXN0cy50ZWFtQFVU
TUIuRURVMB4XDTEwMDYyMzE1MDAwMVoXDTIwMDYyMDE1MDAwMVowgYcxCzAJBgNVBAYTAlVTMQ4w
DAYDVQQIEwVUZXhhczESMBAGA1UEBxMJR2FsdmVzdG9uMQ0wCwYDVQQKEwRVVE1CMQswCQYDVQQL
EwJJUzEVMBMGA1UEAxMMaWRwLnV0bWIuZWR1MSEwHwYJKoZIhvcNAQkBFhJpc3RzLnRlYW1AVVRN
Qi5FRFUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqcGqyZ96WU7De+R//87dPy0Hi
58fX941yuNiaJqGibauz/TO8OcUjnv/tHqtk7gIrZGhStmTh/nY1dTz3X3kwU1GBmWq1m/3cZCzO
SLMkbjylwnLm2LixdAUD0aYi149If0VX+meAnUK9h7SdK7Vu3BQnHIlm1rlIpfqe1vhQeevHaEe7
bAid960EZt88ZCN4nM9O/M9PDBy8nGHW0gm0w0WR5d8jPIxgfTTy+3RkmLnSIo6zJiPrMN3YLtdg
nUlUs56+UuUNdQzyxzq50DA2WqwLerIMK3EkE3jOeluZtLu9ZxrI+66u0dx4BXwcB9+9YngtyAoi
h4XKOyWCQSA7AgMBAAGjge8wgewwHQYDVR0OBBYEFApCLsGavPXicBMUCBGGqLpni1LHMIG8BgNV
HSMEgbQwgbGAFApCLsGavPXicBMUCBGGqLpni1LHoYGNpIGKMIGHMQswCQYDVQQGEwJVUzEOMAwG
A1UECBMFVGV4YXMxEjAQBgNVBAcTCUdhbHZlc3RvbjENMAsGA1UEChMEVVRNQjELMAkGA1UECxMC
SVMxFTATBgNVBAMTDGlkcC51dG1iLmVkdTEhMB8GCSqGSIb3DQEJARYSaXN0cy50ZWFtQFVUTUIu
RURVggkA2lPckOmDawAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAuTW0eEyS4sFr
rF05MDv7a+OEbg2qG2LHdUIk7riOrQoDf8q9YdPidMqiKHh3f0sL4LW8W6dnUl+efTWSrFTxw4eB
bn2gkTxZzfJUV76l29cBtX2cuGIgUVfSMy+LmIzhYO/3G01mhdyGLPVw5PsWGtk7WnYnyClxiiXb
EbX2fxxI6A1h3tlVrjk7VjQUwvAfq1Y2RmH+AjSWcTAu7jzTetIhQnFiIw76j0SgkpfWg6+Fl9I1
VWWWL9ixp7cGsq/pAFbhPZDjEOS0wn0reWGZiHVNBL8acZaN2MDu9gf+HtJDqJzI/lrQ/KurWaxd
4u5L07hPrKQI5y/wgTP3jZ4g8Q==</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml1p:Status>
        <saml1p:StatusCode Value="saml1p:Success"/>
    </saml1p:Status>
    <saml1:Assertion AssertionID="_bcd0404f2c227c74f4e715e76dc36fe7"
        IssueInstant="2016-02-19T22:12:11.692Z"
        Issuer="https://idp.utmb.edu/idp/shibboleth" MajorVersion="1"
        MinorVersion="1"
xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion">
        <saml1:Conditions NotBefore="2016-02-19T22:12:11.692Z"
NotOnOrAfter="2016-02-19T22:17:11.692Z">
            <saml1:AudienceRestrictionCondition>
               
<saml1:Audience>https://federation.nih.gov/FederationGateway</saml1:Audience>
            </saml1:AudienceRestrictionCondition>
        </saml1:Conditions>
        <saml1:AuthenticationStatement
            AuthenticationInstant="2016-02-19T22:12:11.254Z"
AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
            <saml1:Subject>
                <saml1:NameIdentifier
                    Format="urn:mace:shibboleth:1.0:nameIdentifier"
NameQualifier="https://idp.utmb.edu/idp/shibboleth">AAdzZWNyZXQxydF03GOYJ4DukdMvbBoMaga7B+47apReWRGWb1iFO2u+2eZo5jP2Wt8EZE9aeHw/+r5M+R3FnJaG6+ZzOHHNskqXc8HJIBbCPjT8svmgl70DT5N+X3767v6/3eBuNjUW7k2xH5wjt4ZdrqOA</saml1:NameIdentifier>
                <saml1:SubjectConfirmation>
                   
<saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml1:ConfirmationMethod>
                </saml1:SubjectConfirmation>
            </saml1:Subject>
            <saml1:SubjectLocality IPAddress="10.2.68.96"/>
        </saml1:AuthenticationStatement>
    </saml1:Assertion>
</saml1p:Response>

2016-02-19 16:12:12,051 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action
RecordResponseComplete: Record response complete
2016-02-19 16:12:12,051 - INFO [Shibboleth-Audit.SSO:241] -
20160219T221212Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest|_312f9d6a-eee6-435b-abe7-5e3cee6fb48d|https://federation.nih.gov/FederationGateway|http://shibboleth.net/ns/profiles/saml1/sso/browser|https://idp.utmb.edu/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_a1f2c7c0f9a92d2c343348258621d709|rcthomas|urn:oasis:names:tc:SAML:1.0:am:password||AAdzZWNyZXQxydF03GOYJ4DukdMvbBoMaga7B+47apReWRGWb1iFO2u+2eZo5jP2Wt8EZE9aeHw/+r5M+R3FnJaG6+ZzOHHNskqXc8HJIBbCPjT8svmgl70DT5N+X3767v6/3eBuNjUW7k2xH5wjt4ZdrqOA|_bcd0404f2c227c74f4e715e76dc36fe7|




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Not-releasing-attributes-to-specific-EntityID-after-IDP-upgrade-from-2-4-to-3-2-tp7623191.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.

More information about the users mailing list