IDPv3 Attribute Resolver help

[Cantor, Scott]

> In the Moodle code, the Shibboleth attributes are being looked for in
> the PHP $_SERVER variable, eg for :
> 
>         <AttributeRule attributeID="uid">
>             <PermitValueRule xsi:type="ANY" />
>         </AttributeRule>
> 
> Should be read as $_SERVER['uid'].

If that's an IdP filter rule there, then that's simply not true. The name of the attribute inside the IdP has nothing to do with its SAML encoding on the wire, which in turn has nothing to do with how the SP software on the other end exposes it to an application. If they match, that's coincidental. It may be common, but it's not an assumption.

If this is a Shibboleth SP, which it appears to be (you said nothing specifically), the first thing you do with a successful login is check the /Shibboleth.sso/Session page to see what's getting cached from the IdP and under what names. If they show up there, then they'll show up for any protected resources. If not, they aren't being received at all, or they weren't mapped by the SP into the session.

-- Scott