IdP does not release attributes

[Peter Schober]

* Riebeling, Sebastian <sebastian.riebeling at rwth-aachen.de> [2017-07-29 15:22]:
> The "shib2.xml" defines the entityID of my SP as:
> 
>  <ApplicationDefaults entityID="https://sso-med1.imib.rwth-aachen.de/shibboleth"
>                          homeURL="https://sso-med1.imib.rwth-aachen.de/Shibboleth.sso/Session" (...)
> 
> or
> 
>         <SSO entityID="https://sso-med1.imib.rwth-aachen.de/shibboleth">
>               SAML2 SAML1
>             </SSO>

The latter does not define your own entityID, it tells your SP what
IDP to use. You need to stop changing stuff you don't fully understand
and instead refer to the documentation. Trial-and-error will only
cause frustration with something as complex as this.

> I am currently trying to set up an IdP and SP on a Debian machine.

That probably adds to the confusion, of you have both on the same
machine, using the same hostname. (That's not a problem and not a
restrction of the software, it just makes your deployment more
confusion when you're only starting out. I.e., if the idea was to make
the first steps simpler this is not what you have achieved.)

* Riebeling, Sebastian <sebastian.riebeling at rwth-aachen.de> [2017-07-31 18:44]:
> I also turned the "net.shibboleth.idp" and
> "net.shibboleth.idp.attribute" up to DEBUG, in the "logback.xml". My
> resulting process is in the appendix (I cut out the attributes part
> after the session was created I hope this should be enough).

Well, that log snippet you sent ends all lines after 237 characters
(which sometime isn't enough with Shib, so when copying from a
terminal you need to take more care to include the full lines), but
from the last line with "net.shibboleth.idp.attribute.filter" it seems
the filter did not remove the attribute:

  Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
  attribute 'uid' remained after filtering

What does your audit log say about attributes released in that
transaction? (By default those logs are also duplicated into your
process log but you didn't include that part in what you sent either.)

Also note that setting the logging of "net.shibboleth.idp" to DEBUG
will also include everything "below" it, including
net.shibboleth.idp.attribute.  So setting /both/ is redundant.
In this case you only want the latter (net.shibboleth.idp.attribute)
or possibly even only net.shibboleth.idp.attribute.filter.

-peter