<div dir="ltr">Here's my working v2 relying party config for Transact:<div><pre class="" style="border:1px solid rgb(215,215,215);margin:1em 1.75em;padding:0.25em;overflow:auto;color:rgb(0,0,0);font-size:13px;background:rgb(247,247,247)"><!-- BlackBoard Transact does not support encryption; uses AttributeQuery 2014-10-23 -->
<RelyingParty id="<a href="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt">https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</a>"
provider="urn:mace:incommon:<a href="http://alaska.edu">alaska.edu</a>"
defaultSigningCredentialRef="IdPCredential"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
<ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
<ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" encryptAssertions="never" encryptNameIds="never" />
</RelyingParty></pre></div><div class="gmail_extra">Additional unique aspects of the Transact SP are:</div><div class="gmail_extra"><pre class="" style="border:1px solid rgb(215,215,215);margin:1em 1.75em;padding:0.25em;overflow:auto;color:rgb(0,0,0);font-size:13px;background:rgb(247,247,247)"><!-- Bb Transact require something like ePPN in the SAML Subject --></pre></div><div class="gmail_extra"><pre class="" style="border:1px solid rgb(215,215,215);margin:1em 1.75em;padding:0.25em;overflow:auto;color:rgb(0,0,0);font-size:13px;background:rgb(247,247,247)"><!-- Bb Transact requires its own unique FriendlyNames so add definitions and encoders with those FriendlyNames --></pre><div class="gmail_quote">David Bantz</div><div class="gmail_quote">UAlaska</div><div class="gmail_quote"><br></div><div class="gmail_quote">On Tue, May 24, 2016 at 8:24 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">* James McCartin <<a href="mailto:jmccartin@loyola.edu">jmccartin@loyola.edu</a>> [2016-05-24 17:56]:<br>
<span class="">> The SP does ignore the attributes sent in the HTTP POST and then<br>
> queries the IdP. What can I look at to confirm that my v3 IdP<br>
> supports this type of attribute query?<br>
<br>
</span>The documentation? I have no idea how you deployed your IDP, how you<br>
decided supported SOAP queries, on what port, involving what<br>
containers, etc.<br>
<br>
Assuming for now you have properly configured SOAP support, I'd start<br>
with making sure the port you publish for your IDP's<br>
AttributeAuthority endpoints is open on the firewall.<br>
I.e., if <a href="https://shibprodapp.loyola.edu/idp/shibboleth" rel="noreferrer" target="_blank">https://shibprodapp.loyola.edu/idp/shibboleth</a> is your IDP<br>
make sure that <a href="https://shibprodapp.loyola.edu:8443/" rel="noreferrer" target="_blank">https://shibprodapp.loyola.edu:8443/</a> can be reached<br>
from the outside world -- it currently isn't.<br>
<br>
If in doubt look at the SAML Metadata the SP in question has about<br>
your IDP, and make sure the endpoints puiblished there are reachable.<br>
<div class=""><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>