<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>After successful authN and SAML response to a vendor SP, the SP disregards the attributes, immediately issuing the following attribute query using the (correct) transient ID sent in the first response:</div><div><br></div><div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);">15:23:35.546 - DEBUG [PROTOCOL_MESSAGE:113] - </div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"><?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <SOAP-ENV:Body></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <samlp:AttributeQuery xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="https://howkan.alaska.edu/idp/profile/SAML2/SOAP/AttributeQuery">https://howkan.alaska.edu/idp/profile/SAML2/SOAP/AttributeQuery</a>" ID="_E6F1CF2094EFD85C586B0D8CD0329282" IssueInstant="2014-10-22T23:23:35Z" Version="2.0"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</saml:Issuer>">https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</saml:Issuer></a></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <Signature xmlns="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <SignedInfo></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <Reference URI="#_E6F1CF2094EFD85C586B0D8CD0329282"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <Transforms></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <InclusiveNamespaces xmlns="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" PrefixList="#default saml ds xs xsi"/></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> </Transform></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </Transforms></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"/></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <DigestValue>tAShZ+t+fHp3JdnLtUPjWp1M1bM=</DigestValue></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </Reference></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </SignedInfo></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <SignatureValue>Tdxbes8Tb5wIOC3tarmg79ZPGtBJXROxoyLwT4AdDXatqLOZL2l8N8QBNlExoIhgWaL0mpGWT847yZvFYNr8oe7adiJ2JlIA4xoNI159xzdr9DJ7D1KjM0k2XtqiObZZM+kFSMW0Q6I2Hhc8ku6+GqF4ZZxP94aWKcpn5WVCxozphzU+XwOCAmJwoNwnCVsROI8aukJFT4Mn9/+jdXwo/3YUqAHIRuESACVNuaDME7mzmycQJyl63o4OmSVpphR+gqe/Eec/of9twy2W/vBmfCZBwfFNjryR7ZYdnpCV+Usq+jTx+jjfbhyu4oJdL5oleyPw7zzxWh5j6DeF0sSiBg==</SignatureValue></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <KeyInfo></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <X509Data></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <X509Certificate>...</X509Certificate></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </X509Data></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </KeyInfo></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </Signature></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="urn:mace:incommon:alaska.edu" SPNameQualifier="<a href="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt">https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</a>">_8e5887f31d16ec94f0dffb69c75b6213</saml:NameID></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml:Subject></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </samlp:AttributeQuery></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </SOAP-ENV:Body></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"></SOAP-ENV:Envelope></div></div><div><br></div><div>My IdP logs show the following WARN:</div><div><br></div><div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;">WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AttributeQueryProfileHandler:95] - SAML 2 Attribute Query profile is not configured for relying party org.opensaml.ws.soap.soap11.impl.EnvelopeImpl@2af94feb</div></div><div><br></div><div>And then issues a corresponding SAML response:</div><div><br></div><div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);">DEBUG [PROTOCOL_MESSAGE:74] - </div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"><?xml version="1.0" encoding="UTF-8"?><soap11:Envelope xmlns:soap11="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <soap11:Body></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_f0faf266e14efe840ba8f2a25a32b313" InResponseTo="_E6F1CF2094EFD85C586B0D8CD0329282" IssueInstant="2014-10-22T23:23:35.550Z" Version="2.0"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:alaska.edu</saml2:Issuer></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2p:Status></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied"/></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2p:StatusCode></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2p:StatusMessage>SAML 2 Attribute Query profile is not configured for relying party org.opensaml.ws.soap.soap11.impl.EnvelopeImpl@2af94feb</saml2p:StatusMessage></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2p:Status></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2p:Response></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </soap11:Body></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194);"></soap11:Envelope></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 16px; position: static; z-index: auto;"><br></div></div><div><br></div><div><div style="font-size: 14px;">It’s certainly true that there is no such relying party as <span style="background-color: rgb(255, 250, 194); font-family: Monaco;">org.opensaml.ws.soap.soap11.impl.EnvelopeImpl@2af94feb in my configuration</span>. </div><div style="font-size: 14px;">Should there be? Where did that relying party name come from?</div></div><div></div><div></div></body></html>