Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

[Nate Klingenstein]

Joel,

Your root problem is that there are no attributes being sent in the initial SAML response from the IdP to the SP, so the SP has to make a guess as to whether it's supposed to perform a query to acquire additional attributes.  Older versions of the SP automatically made this query if and only if no attributes were being received.

I would suggest looking at idp-process.log on DEBUG to see why there are no attributes either being resolved or released and fix that rather than trying to get the back-channel query to work, which is considered a worse solution in most instances anyway, and would likely not resolve the underlying issue of no attributes being supplied.

Hope this helps,
Nate.