Followup to previous question about Shibboleth 5.1.4 Attribute Authority functionality

[o haya]

Hi,

Awhile, with some help from some of you, I wrote a small Java app that uses
OpenSAML to generate a signed AttributeQuery request, and now I am trying
to test using the generated AttributeQuery requests with the Shibboleth IdP
that I had setup a while ago (also with LOTS of help from some of you all).

So basically I have a small bat file (this is on Windows) that runs the
AttributeQueryGenerator app with parameters, to generate a signed
AttributeQuery, then the batch runs curl to do a POST with the request.

I've struggled with getting through all of the Shibboleth AA
security-related stuff (matching certs, etc.) and I now am able to send a
request to the Shibboleth AA and get a SAML response with "Success", but
response does not have any attributes that were in the AttributeQuery, and
in fact, the response does not even have an <AttributeStatement> element.

>From all the testing that I've done and from the idp-process.log I can see
that Shibboleth is getting the attributes from the LDAP (and OPENDJ LDAP on
the same machine as Shibboleth), but then Shibboleth appears to be
"dropping" the attributes and saying there are 0 attributes.

Also when I run aacli, I DO see the attributes in the aacli output.

So I was wondering if anyone might have some suggestions/advice as to why
the attributes are not being sent back in the SAML response?

Thanks in advance!!

Jim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260209/dc50e99a/attachment.htm>