<div>I have a setup where I am creating an SP with SimpleSAMLphp to an InCommon IDP at Northwestern University (uses Shibboleth 1.3).</div><div><br></div><div>My SP does not support attribute query so the admin at NU set us up to use attribute push.</div>
<div><br></div><div>Things work fine when the client (subject web browser not my SP) is on campus, connected to NU WiFi, or on VPN.</div><div><br></div><div>However, when the client (subject web browser) is off campus the AttributeStatement is not sent to my SP.</div>
<div><br></div><div>I realize that Shib 1.3 is not supported, but I was wondering if anyone knew if there was a configuration setting we missed, something else subtle going on, or a good place to start looking.</div><div>
<br></div><div>Thanks</div><div><br></div><div>Below are snippets of what my SP is receiving in each case. I have verified this behavior several different was (external servers, smart phones, regular computers, etc.)</div>
<div><br></div><div>On campus assertion example - data pulled from SP log BEFORE parsing - raw XML snippet:</div><div><br></div><div> <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" AssertionID="_37893b574f4b02c7424f8f7dc4528dd7" IssueInstant="2012-04-02T15:27:41.214Z" Issuer="urn:mace:incommon:<a href="http://northwestern.edu">northwestern.edu</a>" MajorVersion="1" MinorVersion="1"></div>
<div> <Conditions NotBefore="2012-04-02T15:27:41.214Z" NotOnOrAfter="2012-04-02T15:32:41.214Z"></div><div> <AudienceRestrictionCondition></div><div> <Audience><a href="https://adeassodev.northwestern.edu/simplesaml/module.php/saml/sp/metadata.php/nu_passport">https://adeassodev.northwestern.edu/simplesaml/module.php/saml/sp/metadata.php/nu_passport</a></Audience></div>
<div> </AudienceRestrictionCondition></div><div> </Conditions></div><div> <AuthenticationStatement AuthenticationInstant="2012-04-02T15:27:41.214Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified"></div>
<div> <Subject></div><div> <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="urn:mace:incommon:<a href="http://northwestern.edu">northwestern.edu</a>">XXX</NameIdentifier></div>
<div> <SubjectConfirmation></div><div> <ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod></div><div> </SubjectConfirmation></div><div> </Subject></div>
<div> <SubjectLocality IPAddress="129.105.233.157"/></div><div> </AuthenticationStatement></div><div> <AttributeStatement></div><div> <Subject></div><div> <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="urn:mace:incommon:<a href="http://northwestern.edu">northwestern.edu</a>">XXX</NameIdentifier></div>
<div> <SubjectConfirmation></div><div> <ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod></div><div> </SubjectConfirmation></div><div> </Subject></div>
<div> <Attribute xmlns:typens="urn:mace:shibboleth:1.0" AttributeName="urn:mace:dir:attribute-def:uid" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"></div><div>
<AttributeValue xsi:type="typens:AttributeValueType">mby076</AttributeValue></div><div> </Attribute></div><div> <Attribute xmlns:typens="urn:mace:shibboleth:1.0" AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"></div>
<div> <AttributeValue Scope="<a href="http://northwestern.edu">northwestern.edu</a>" xsi:type="typens:AttributeValueType">mby076</AttributeValue></div><div> </Attribute></div>
<div> </AttributeStatement></div><div> </Assertion></div><div><br></div><div>Off campus assertion (missing AttributeStatement) - data pulled from SP log BEFORE parsing - raw XML snippet:</div><div><br></div>
<div> <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" AssertionID="_62c0e0368a6da881a94eb2f113feb8da" IssueInstant="2012-04-02T15:33:03.668Z" Issuer="urn:mace:incommon:<a href="http://northwestern.edu">northwestern.edu</a>" MajorVersion="1" MinorVersion="1"></div>
<div> <Conditions NotBefore="2012-04-02T15:33:03.668Z" NotOnOrAfter="2012-04-02T15:38:03.668Z"></div><div> <AudienceRestrictionCondition></div><div> <Audience><a href="https://adeassodev.northwestern.edu/simplesaml/module.php/saml/sp/metadata.php/nu_passport">https://adeassodev.northwestern.edu/simplesaml/module.php/saml/sp/metadata.php/nu_passport</a></Audience></div>
<div> <Audience>urn:mace:incommon</Audience></div><div> </AudienceRestrictionCondition></div><div> </Conditions></div><div> <AuthenticationStatement AuthenticationInstant="2012-04-02T15:33:03.668Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified"></div>
<div> <Subject></div><div> <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="urn:mace:incommon:<a href="http://northwestern.edu">northwestern.edu</a>">XXX</NameIdentifier></div>
<div> <SubjectConfirmation></div><div> <ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod></div><div> </SubjectConfirmation></div><div> </Subject></div>
<div> <SubjectLocality IPAddress="209.114.43.98"/></div><div> </AuthenticationStatement></div><div> </Assertion></div><br clear="all">Mike Basil<br>312.961.7798<br><br>
<br>