SOAPTransport certificate error

[Peter Schober]

* Yasser Afifi <yasser at 3dissue.com> [2016-01-22 13:52]:
> I have two questions please:
> does the idp send attributes to SP in SOAP? if so, is this the only way to
> send attributes?

SAML specifies several methods (Procotol Bindings) and the SP asking
the IDP for attributes via SOAP is just one of them.

> My second question is while configuring IDP with SP, i get this error on
> the sp logs:

> CURLSOAPTransport failed while contacting SOAP endpoint (
> https://localhost:8443/idp/profile/SAML2/SOAP/AttributeQuery): SSL
> certificate problem: application verification failure

Does this default configuration from your shibboleth2.xml explain this
sufficiently?

  <!-- Use a SAML query if no attributes are supplied during SSO. -->
  <AttributeResolver type="Query" subjectMatch="true"/>

I.e., if the IDP had sent anything at all, the SP wouldn't have
attempted the query.
The fact that the query failed means that your IDP's attribute
authority (the part that allows such queries to work) is
misconfigured.

So, what you can do is
1. Comment out the AttributeResolver line above in your SP
2. Fix the attribute release on your IDP
3. Fix the Attribute Authority config on your IDP/AA
   or
   Remove support for attribute queries (and Artifacts) from the
   SAML metadata describing that IDP.

Cheers,
-peter