SP not receiving attributes from our IdP

[Cantor, Scott]

On 9/15/16, 8:23 PM, "users on behalf of Gould, Samuel" <users-bounces at shibboleth.net on behalf of Samuel.Gould at sdstate.edu> wrote:

> - My organization is simultaneously running a Shib v2 and Shib v3 IdP
>      - We just recently spun up the Shib v3 IdP, and gave it a different hostname
>        than the Shib v2 IdP; the entity IDs are the same

I won't belabor the point, but this is the fundamental mistake, you simply don't, and don't need, to do this. The swap should be done by testing as much as feasible ahead of time, and then simply re-address in DNS and do final cleanup.

> - According to the SAML Tracer FF plugin, no `<AttributeStatement>' is sent

> - Verified that our IdP provides correct SAML assertions in response to this
>        SP (determined with SAML Tracer FF plugin)
 
Those statements are mutually exclusive.

If the IdP sends no AttributeStatement, then either it's a SAML 1.1 SP or no attributes were resolved or none were released. That's it.

-- Scott