<html><body><div style="font-family: georgia,serif; font-size: 12pt; color: #000000"><div>I am working with an instance of Shibboleth SP 2.6, trying to have it issue attribute queries. This is a fairly vanilla SP with little to no mods. In trying to understand changes required to have the SP do so, I have the following:</div><div><br data-mce-bogus="1"></div><div>1. Ensure the IdP sends no attributes back to the SP.</div><div>2. Ensure a nameid is provided in the response (transient?)</div><div>3. Ensure the IdP metadata loaded by the SP has the appropriate AttributeAuthority elements, bindings, etc. </div><div>4. The SP does by default seem to have an attribute resolver element of type query, which based on the wiki should do the trick.</div><div><br data-mce-bogus="1"></div><div>First, is the above list accurate? </div><div><br data-mce-bogus="1"></div><div>Assuming it is, what I see happening is the SP rejects the initial response with "AttributeStatement must have at least one attribute" which seems odd given #1. I suspect something else needs configuring in order to have the SP switch to using attribute queries. Suggestions on what I might have missed? </div><div><br></div><div data-marker="__SIG_PRE__"><div>--Misagh</div></div></div></body></html>