Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

[Joel Saunders]

I'm confused...  (Obviously not hard to do I guess!)

The IDP metadata has this in it:

<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://rfidpdev1.rfsuny.org:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>

If I telnet to rfidpdev1.rfsuny.org on 8443 from the SP host, I get the no route to host error.
But I didn't think that there were any SP to IDP communications going on here.
I thought that the user's browser handled talking to the SP or IDP itself and interhost communication was done on the messages passed in the URLs.

I see the no route to host error in the log dir of the SP so that implies to me that the SP is trying to communicate directly to the IDP to do the Attribute Value query.   Was this the case for V2 IDPs or am I just way off base?

Please advise...

Thanks for any and all comments...

... Joel


From: users <users-bounces at shibboleth.net> On Behalf Of Joel Saunders
Sent: Wednesday, January 30, 2019 1:33 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

Hold on... I may have a network issue...

I see this in the SP's shibd_warn.log:

2019-01-30 13:22:14 ERROR Shibboleth.AttributeResolver.Query [65] [default]: exception during SAML query to https://rfidpdev1.rfsuny.org:8443/idp/profile/SAML2/SOAP/AttributeQuery: CURLSOAPTransport failed while contacting SOAP endpoint (https://rfidpdev1.rfsuny.org:8443/idp/profile/SAML2/SOAP/AttributeQuery): Failed connect to rfidpdev1.rfsuny.org:8443; No route to host
2019-01-30 13:22:14 ERROR Shibboleth.AttributeResolver.Query [65] [default]: unable to obtain a SAML response from attribute authority

When on the SP, I check the connection with the following;

                telnet to rfidpdev1.rfsuny.org 8443

and I get the following:

telnet: connect to address aa.bb.cc.dd: No route to host   (changed the ip for this message, but it's correct)

Question:   I didn't think that the IDP actually communicated with the SP.  I thought that the browser session was the link between the two.
                Is this a config option that needs to be changed?  Is SOAP required or optional?

Please advise... I don't want to have to contact my networking group if it's possible.

... Joel

From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of Joel Saunders
Sent: Wednesday, January 30, 2019 1:10 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

Show attribute values is on at the SP.

I really didn't do much after the initial upgrade except I got the LDAP backend dir to work.
Now the user can log in and is routed to the application, but it seems that the attribute values that used to be passed to the SP from the V2 IDP are not there when authenticated thru the V3 IDP.

In the IDP process log I see a bunch of DEPRECIATED WARNINGS but no ERRORS.

I reviewed the upgrade docs, but don't see any mention of what to do in the case.

Can anyone assist/point me in the right direction?

Please advise...

Joel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190130/c6be15b5/attachment.html>