IDPv3 Attribute Resolver help

[Tim Williams]

On 15/11/16 14:52, Cantor, Scott wrote:
>> I'm running Moodle on Apache, with the Apache Shibboleth modules.  Sorry
>> if that wasn't fully clear. /Shibboleth.sso/Session reports no
>> attributes in the session.
> 
> Then either nothing was released or nothing was mapped/extracted from the assertion, either of which are addressed by the logs.

I'm seeing this in the IDP log after clicking the button to approve the
information release:

20161121T131922Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_5c91f4698bf7be725ee038bf9a2f8b98|https://ssotestmoodle.medialibrary.com/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp.medialibrary.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_7e0438ab9937de176d69a9d8f85b7ffb|dave_instructor|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,mail,surname,givenName|AAdzZWNyZXQx4tPwp38lltZnFLMGn1jeoNB1Kv8Ov03wBDlAoQ8bZjamuOOo8Z16AmRwHyHSSl7Iwf2cCyq30BdK9c3d5njKzRQfWQVi+xMUGlueZ6yyhUFSyK+mQs+LR8m0+MtWI37ms13q056TZqI1imYR79tEgYOtWycZxfEPk+uHuQ9IHA==|_f7a50945715e5dcf9b3ef31bf513ef59|

Which lists the attribute names I was expecting. However, it's not clear
to me if this is confirming that the parameters were actually sent to
the SP or not.

What should I be seeing in the log if the parameters are being correctly
released and sent to the SP? Also, what elements of the logging need to
be set to debug to pick up what is is happening here (I've currently got
LDAP and opensaml set to DEBUG)?

Shibboleth.sso/Session lists no attributes, so my working assumption is
that the attributes still aren't being sent to the SP by the IDP even
though they are listed with the correct id's and values on the
information release page after the initial login. How do I confirm this
assumption?

The Apache Shib module is designed to pass through the attributes as
server environment variables (I have ShibUseEnvironment On in the
config), so the attributes should appear in the PHP $_SERVER global
variable. However, I'm not seeing the attributes. I've got apache
logging set to "debug", but there is nothing in the log which seems to
relate to attributes. What am I looking for in the Apache log to confirm
that it has received the attributes? Does the apache config need
anything else to tell it to pass through the attributes?

All help gratefully received!

Kind Regards, Tim W

-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.