Shibboleth IdP not passing AD LDAP attributes to TestShib SP

[Peter Schober]

* Matthew X. Economou <xenophon at irtnog.org> [2017-12-13 04:49]:
> In general you should release the REFEDS R&S attribute bundle to all SPs.

While you certainly can do that the R&S bundle (and specification) was
created get those attributes released to services that qualify as "R&S
services" as per the R&S specification (at least, if you will).
So more commonly you'd limit release of these attributes to R&S SPs.

> Again, you don't set idp.attribute.resolver.LDAP.returnAttributes,
> which means the LDAP connector won't return anything at attribute
> resolution time.

If you don't ask for attributes in an LDAP search operation the LDAP
DSA will simply return all the attributes your DN has permissions to
see.  You only set returnAttributes to *limit* the attributes you want
the DSA to return.
(Well-behaved DUAs should always do that, of course, but not asking
for anything will not result in problems recieving attributes.)

-peter