Not getting attributes in headers

[Peter Schober]

* Bryan Wooten <bryan.wooten at utah.edu> [2016-07-14 15:15]:
> I am not sure if this is my application's problem or an SP issue.

Then check the SP's transaction.log and/or the SP's session handler at
(by default) /Shibboleth.sso/Session after any logni attempts.

> I have a trivial SP that simply displays the attributes returned
> from the IDP. It assumes the attributes are returned as header
> elements.
> 
> Using SAML Chrome plugin I see attributes returned to the browser like:
> 
> <saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:type="xs:string">WOOTEN</saml2:AttributeValue>

That's bad as that means you have no encryption of the data on the
wire. Make sure the SP has a certificate (usable for encryption) in
its SAML Metadata available to the IDP.

> My java code  [...]

What Java servlet container are you using? Unless that's Jetty you
should use AJP (instead of HTTP proxying) and environment variables
instead of HTTP Request Headers.

> This app was working fine when the SP was pointing to our  Shib3 IDP
> instance, but we changed the SP to use or Shib2 test IDP.

Then I'd start by making sure the Shib SP sees the same attributes.
-peter