SP not receiving attributes from our IdP

[Gould, Samuel]

Hi David,

Point taken on authentication statements vs. SAML assertions.  My terminology
was inaccurate; I meant to say "authentication statements".

I will have my colleague increase the logging level as soon as possible to see
if that helps.  (Of course, the problem there will be finding a good time for
both of us outside of working hours in order to debug and change the logging
level back to normal.)

Thanks for your tip re: entityID.  We release different sets of attributes to
different SPs.  I remember verifying the trailing slash, but forgot whether or
not I specifically looked at the protocol.  I will double-check.

--Sam

From: users <users-bounces at shibboleth.net> on behalf of IAM David Bantz <dabantz at alaska.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, September 15, 2016 at 7:41 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SP not receiving attributes from our IdP


On Thu, Sep 15, 2016 at 4:23 PM, Gould, Samuel <Samuel.Gould at sdstate.edu<mailto:Samuel.Gould at sdstate.edu>> wrote:
  - According to the SAML Tracer FF plugin, no `<AttributeStatement>' is sent...
  - Verified that our IdP provides correct SAML assertions in response to this
    SP (determined with SAML Tracer FF plugin)

You may consider an authentication statement without attribute statement to be "correct"
and it may be all that's needed by some SP's, but if your SP requires a value of the attribute
eduPersonPrincipalName, you SAML assertion is at least incomplete!

Log file idp-process.log should have details of the interaction; increase logging level to debug
if there isn't enough to identify why no attributes are being released.

Based on my experience, look first to match of your release policy to the entityID of the SP
(if you're not releasing the same attribute bundle to every SP) - including http/https and
presence or absence of trailing / in the names.

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160916/9720b1e4/attachment.html>