<div dir="ltr">I'm struggling with a similar situation (different vendor). Have you included definition of transient principal connector?<div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/TransientPrincipalConnector">https://wiki.shibboleth.net/confluence/display/SHIB2/TransientPrincipalConnector</a><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 26, 2015 at 6:22 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Morris, Andi <<a href="mailto:amorris@cardiffmet.ac.uk">amorris@cardiffmet.ac.uk</a>> [2015-02-26 14:29]:<br>
<span class="">> 20:33:56.393 - WARN<br>
> [edu.internet2.middleware.shibboleth.idp.profile.saml1.AbstractSAML1ProfileHandler:568] - Error resolving principal name for SAML request from relying party '<a href="https://academic.mintel.com/shibboleth" target="_blank">https://academic.mintel.com/shibboleth</a>'. Cause: No information associated with transient identifier: _15c9b9b5bd0c3aa11d088549e802a3dd<br>
<br>
</span>Note that this SP speaks SAML2 just fine (I just tried to log at<br>
<a href="http://academic.mintel.com/" target="_blank">http://academic.mintel.com/</a> via "Federated Log In"), so there should<br>
be no reason to use (a) use SAML1, and (b) attribute queries.<br>
<br>
While that's no explanation why the attribute query failed (which a<br>
Shib IDP supports by default once you have set up the SOAP port<br>
correctly, which seems to be the case here) you might still prefer to<br>
remove the reason this happens in the first place.<br>
<br>
Then you can still try to find out whether your IDP works with<br>
Attribute Queries (potentially involving an SP of your own, or one<br>
provided by someone else, e.g. the UKfederation or TestShib) or<br>
whether you'd like to continue supporting queries in the first place.<br>
<br>
E.g. if all you ever send to such SAML1 SPs is an eduPersonAffiliation<br>
and/or the common-lib-terms eduPersonEntitlement attribute value you<br>
might consider pushing those attributes over the browser, unencrypted.<br>
Then most SPs won't see a need to issue an attribute query, not even<br>
via SAML1.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>