Backchannel failing after upgrade

[James Drews]

Yeah, from all the debug logs I've looked at, the IDP is sending attributes, so there must be some SAML 1.1 going on... More to dig in to.


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, January 20, 2017 2:42 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Backchannel failing after upgrade

On 1/20/17, 3:36 PM, "users on behalf of James Drews" <users-bounces at shibboleth.net on behalf of james.drews at wisc.edu> wrote:

>    The explanation I got was we have sites that will accept 
> authentication from different IDP's. The configuration has the <AttributeResolver type="Query"> set to turn around and ask the IDP used for authentication for the attributes.

That plugin is for SAML 1.1 use and dates back to the transition phase to SAML 2.0. You don't need to be supporting queries and if it's being used, you're either using SAML 1.1, which should be addressed by migrating to SAML 2.0, or you're not sending them any attributes because of policy, which won't change if they query for them.

SAML 2.0 SSO includes the attributes, there's no query.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net