attribute-map.xml changes not visible in apache

[David Balažic]

Cantor, Scott wrote:

> >    If we change the attribute-map.xml file  and restart shibd, it 
> > detects the changes (it reports an error if we put a syntax error in the file on purpose), but the web application still sees the old definitions.
>
> And you probably didn't restart Apache.

OK, after the restart problem is sorted out, the original problem persists.
The status now:
 - Changes in attribute-map.xml are visible in the apache (headers sent out to the proxied backend server, according to dumpio log)
 - one attribute continues to be missing

Excerpt from the attribute-map.xml (OID is anonymized):

<Attribute name="urn:oid:1.3.6.1.4.1.12345.1.1.5" id="foo_Value"/>

>From the SAML response (from shibd.log):

<saml2:Attribute FriendlyName="foo"
	Name="urn:oid: 1.3.6.1.4.1.12345.1.1.5"
	NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
	<saml2:AttributeValue
		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		xsi:type="xsd:string">some_string_value_here</saml2:AttributeValue>
</saml2:Attribute>

And from the shibd.log (changed actual provider name and some values, consistently with above changes/anonymization):

DEBUG Shibboleth.AttributeDecoder.String [3] [default]: decoding SimpleAttribute (foo_Value) from SAML 2 Attribute (urn:oid: 1.3.6.1.4.1.12345.1.1.5) with 1 value(s)

DEBUG Shibboleth.AttributeFilter [3] [default]: applying filtering rule(s) for attribute (foo_Value) from (IDPNAME)

INFO Shibboleth-TRANSACTION.Login [3] [default]: |_58ad1a36b3ddce814961312af25724d9|IDPNAME|_660597c44b181778ae69f3785c3e4abd|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|2021-02-**T**:**:**|foo_Value(1),idpname_certificate(1),idpname_ds(1),idpname_ds_m(1),idpname_e_mail(1),idpname_e_mail_m(1),idpname_lang(1)|AAdz_long_base64_string_here__Ii9|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||urn:oasis:names:tc:SAML:2.0:status:Success|||Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko|10.*.*.61


So it seems foo_Value is processed properly, but then it does not appear in the HTTP headers sent out by apache (visible in dumpio output from apache, not included here, and also in the backed application logs).

Where to look?
This used to work a few weeks ago, but "somebody changed something" and now it doesn’t (meaning the above missing attribute).
No, nobody knows who changed what. I was just assigned with the "fix this" task.

Regards,
David