Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

[Joel Saunders]

Nate,

Thanks for the quick response.

I too don't want it to do the back-channel query.

The same SP works fine with another IDP (with back-channel query) but doesn't get any attributes from the V3 Shib IDP, so I don't think that the SP is the issue, but I could be wrong.

How would you proposed that I troubleshoot this?
	I guess that I should begin by putting debug on at both IDP and SP?   Unless there are other steps that I could take?


Thanks for your assistance in this matter..

Joel



-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Nate Klingenstein
Sent: Wednesday, January 30, 2019 3:45 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

Joel,

Your root problem is that there are no attributes being sent in the initial SAML response from the IdP to the SP, so the SP has to make a guess as to whether it's supposed to perform a query to acquire additional attributes.  Older versions of the SP automatically made this query if and only if no attributes were being received.

I would suggest looking at idp-process.log on DEBUG to see why there are no attributes either being resolved or released and fix that rather than trying to get the back-channel query to work, which is considered a worse solution in most instances anyway, and would likely not resolve the underlying issue of no attributes being supplied.

Hope this helps,
Nate.
-- 
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=bFSfV3JDZVFjkVdrOg1Bnsgwku-x_EGNRi2KNxwvClI&r=WG-pl0WpwyPk-r6oNnUhsoAUBdVNpC8ryokTG8RkffA&m=so1ptDDFRs09TF5EFkX_69aHe8NoAIWmJVpDHt67u6o&s=1ltBKA87A7dr1JraGvVa---j4rESUFz129YFiy1AdCU&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net