<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I’m confused by this statement the SSOProfileHandler.completeAuthentication eventually calls ShibbolethSAML2AttributeAuthority->getAttributes which as the following code:<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> </span><span style="font-size: 10pt; font-family: Consolas; color: rgb(63, 127, 95);">// get attributes from the message</span><span style="font-size: 10pt; font-family: Consolas;"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> Set<String> queryAttributeIds = getAttributeIds(requestContext.getInboundSAMLMessage());</span><span style="font-size: 10pt; font-family: Consolas;"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> requestedAttributes.addAll(queryAttributeIds);</span><span style="font-size: 10pt; font-family: Consolas;"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> <span class="Apple-converted-space"> </span></span><span style="font-size: 10pt; font-family: Consolas; color: rgb(63, 127, 95);">// get attributes from metadata</span><span style="font-size: 10pt; font-family: Consolas;"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> Set<String> metadataAttributeIds = getAttribtueIds(requestContext.getPeerEntityMetadata());</span><span style="font-size: 10pt; font-family: Consolas;"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 10pt; font-family: Consolas;"> requestedAttributes.addAll(metadataAttributeIds);</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">My understanding of reading this is that the AttributeResolver should get the requested attributes both from the incoming request and the metadata. I am assuming that further in the resolution process in the ShibbolethSAML2AttributeAuthority->resolveAttributes</span></div></div></div></blockquote><div><br></div><div>I'm still not sure what you are trying to do here (or perhaps I should say, I'm not sure what problem you think any failure to pick up the SP's requested attributes is causing) but there is definitely something smelly in that code, as it also seems to be doing this:</div><div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> <span style="color: #931a68">protected</span> Set<String> getAttribtueIds(EntityDescriptor metadata) {</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> Set<String> metadataAttributeIds = <span style="color: #931a68">new</span> HashSet<String>();</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> AttributeAuthorityDescriptor aaDescriptor;</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> <span style="color: #931a68">if</span> (metadata != <span style="color: #931a68">null</span>) {</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> aaDescriptor = metadata.getAttributeAuthorityDescriptor(SAMLConstants.<span style="color: #0326cc">SAML20P_NS</span>);</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> <span style="color: #931a68">if</span> (aaDescriptor != <span style="color: #931a68">null</span>) {</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> List<org.opensaml.saml2.core.Attribute> metadataAttributes = aaDescriptor.getAttributes();</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> metadataAttributeIds = getAttributeIds(metadataAttributes);</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(57, 51, 255);"><span style="color: #000000"> </span><span style="color: #0326cc">log</span><span style="color: #000000">.debug(</span>"metadata contains the following attributes: {}"<span style="color: #000000">, metadataAttributeIds);</span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> }</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> }</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> <span style="color: #931a68">return</span> metadataAttributeIds;</div><div style="margin: 0px; font-size: 11px; font-family: Monaco;"> }</div><div><br></div><div>In other words, it appears to be looking in the peer's (SP's) metadata for an attribute authority descriptor... which won't be present. I don't see any evidence that it is looking at the SP's RequestedAttribute information at all. This may be because it's possible to have many of those, but I will have to leave it to someone who knows that code better to be definitive.</div><div><br></div><div>(Scott has replied already saying that this code isn't operational, but I'm not sure if the above is new information.)</div><div><br></div></div></div><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">That the getRequestedAttributesIds method returns the requested attributes retrieved from the incoming request and metadata. Am I mistaken? My understanding of reading the code is that it will first filter the attributes by what is requested in the incoming request and metadata and also by the filter policy configured in the IdP.</span></div></div></div></blockquote><div><br></div><div>One important thing to understand is that you're talking here about *filtering*, whereas the message you're concerned about is talking about *resolution*. "Resolving all attributes" just means the IdP is acquiring all possible attributes (from places like LDAP, or whatever you've configured), and that's a largely independent process to filtering out the ones that aren't required for the particular relying party.</div><div><br></div><div>Other than the message you're seeing, you probably need to tell us what is going wrong in terms of the messages between the SP and IdP.</div><div><br></div></div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-tab-span" style="white-space: pre; "> </span>-- Ian<br></div><div><span class="Apple-style-span" style="font-size: medium; "><br></span></div></span></span><br class="Apple-interchange-newline">
</div>
<br></body></html>