Unable to make Shib Attribute Query

[Cantor, Scott]

On 6/7/17, 9:45 AM, "users on behalf of Chauhan, Somya (ELS-CON)" <users-bounces at shibboleth.net on behalf of s.chauhan at elsevier.com> wrote:

> Yes, we are using Shibboleth at both the ends .

I don't believe the error messages you've been posting are from a Shibboleth IdP.

> We upgraded shibboleth version from 2.4 to 2.6 .

That doesn't have any affect on queries. If you changed the key, then change it back. If you didn't, there's no non-firewall reason why anything would change.

> I have attached  the request and response what we are trying. Correct me what I am missing .

I have no idea, because, again, the error is not one that our software produces. If the IdP is using Shibboleth, the error is from some other piece of software mediating the certificate authentication and there's nothing I can do to diagnose that.

Again, there is just no difference here. If client TLS worked with 2.4 it should work with 2.6, and if the error message is from the IdP end then there's nothing you can do to diagnose that without getting the IdP involved.

Stop using queries. They are not supported by the majority of newer IdPs and will not even be enabled by default in the future. Whatever you're doing needs to be re-thought. Specific communties who control their IdPs may be able to continue using them, but at scale, they will not be supported.

-- Scott