Upgraded IDP from v2 to v3 - user can login but no attributes are being received at the SP

[Peter Schober]

* Joel Saunders <Joel.Saunders at zones.com> [2019-01-31 18:48]:
> Looks like the attribute-filter.xml file needed to have the
> attributes that I needed passed defined in it.

That shouldn't be news to someone trying to perform an upgrade from
IDPv2 -- the IDP has never released attributes to any SP unless
specifically told to do so.

> I had to add the following to the attribute-filter.xml file for the
> others to be passed on to the SP:
> 
>     <!--  Release the UID to anyone -->
[...]
>     <!--  Release the EPPN to anyone -->
[...]
>     <!--  Release the DEPTNO to anyone -->

Note that this does not release those attributes only to "the SP": It
will release them to any SP known to your IDP via metadata. Depending
on how many and what those SPs are, and whether consent is involved or
not, that may not be a sane policy to have.

Check the distributed example filter in dist/conf/attribute-filter.xml
(esp the simple examples at the bottom) for ways to limit this to
specifc SPs.

You could also provide a bit of context about your deployment which
would allow people to suggest policies that both scale as well and
don't throw control out the window.

-peter