<div dir="ltr">In my organization we have a set of machines running apache2 and shibboleth-sp.  These machines are behind a firewall and cannot connect directly to the idp. <div><br></div><div>On newly authenticated requests the shibd daemon is trying to contact the IdP directly.  What in my config could be causing this?  All of our attributes should be resolved in the response from the idp to the sp.  <br></div><div><br></div><div><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.SSO.SAML2 [1]: extracting pushed attributes...</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.AttributeExtractor.XML [1]: unable to extract attributes, unknown XML object type: saml2p:Response</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.AttributeDecoder.NameID [1]: decoding NameIDAttribute (persistent-id) from SAML 2 NameID with Format (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent)</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.AttributeExtractor.XML [1]: unable to extract attributes, unknown XML object type: saml2:AuthnStatement</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.AttributeFilter [1]: filtering 1 attribute(s) from (<a href="https://idp.xyz.com/idp/shibboleth">https://idp.xyz.com/idp/shibboleth</a>)</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.AttributeFilter [1]: applying filtering rule(s) for attribute (persistent-id) from (<a href="https://idp.xyz.com/idp/shibboleth">https://idp.xyz.com/idp/shibboleth</a>)</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.SSO.SAML2 [1]: resolving attributes...</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.AttributeResolver.Query [1]: attempting SAML 2.0 attribute query</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG XMLTooling.SOAPTransport.CURL [1]: getting connection handle to <a href="https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery</a></p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG XMLTooling.SOAPTransport.CURL [1]: nothing free in pool, returning new connection handle</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG Shibboleth.SOAPClient [1]: prepping SOAP transport for use by application (t-saml-auth-jer)</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG XMLTooling.SOAPClient [1]: marshalled envelope:<S:Envelope xmlns:S="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"><S:Body><samlp:AttributeQuery xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_e5b24995a8bebb0061bc91c3c1855039" IssueInstant="2015-09-22T19:02:58Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="http://my-service.abc.com/">my-service.abc.com/</a></saml:Issuer><saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="<a href="https://idp.xyz.com/idp/shibboleth">https://idp.xyz.com/idp/shibboleth</a>" SPNameQualifier="<a href="http://my-service.abc.com/">my-service.abc.com/</a>">testuser</saml2:NameID></saml:Subject></samlp:AttributeQuery></S:Body></S:Envelope></p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 DEBUG XMLTooling.SOAPTransport.CURL [1]: sending SOAP message to <a href="https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery</a></p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 ERROR Shibboleth.AttributeResolver.Query [1]: exception during SAML query to <a href="https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>: CURLSOAPTransport failed while contacting SOAP endpoint (<a href="https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>): couldn't connect to host</p><p style="margin:0px;font-size:11px;font-family:Monaco">













</p><p style="margin:0px;font-size:11px;font-family:Monaco">2015-09-22 19:02:58 ERROR Shibboleth.AttributeResolver.Query [1]: unable to obtain a SAML response from attribute authority</p></div><div><br></div><div>Here's my attribute-map.xml.</div><div><br></div><div><div><Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"></div><div>   <!-- SAML 2.0 NameID Format: --></div><div>   <Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id"></div><div>       <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$Name" defaultQualifiers="true"/></div><div>   </Attribute></div><div></Attributes></div></div><div><br></div><div>Thanks,</div><div>  Jeremy</div></div>