[satosa-users] No assertions in SATOSA's SAML responses

Dear all, I need help understanding why SATOSA isn't passing the IdP assertions through to an SP. SATOSA sends it a successful authentication response, but it's devoid of any attributes. I know that SATOSA gets the right assertion from the IdP because there's a "backend received attributes" log entry that includes the expected values. I see that the PrimaryIdentifier plugin correctly identifies the ePPN because there's a "PRIMARY_IDENTIFIER: Setting attribute uid" log entry. I also see the LdapAttributeStore plugin skip processing, as expected. But when SATOSA routes the request to the Saml2IDP frontend, it logs the following: ``` Filter: [] returning attributes {} ``` And then the SAML response doesn't include any attributes. Here's my complete configuration except for passwords and keying material: https://gist.github.com/xenophonf/d07ab00a30e5559674936e3a549d0141 What am I missing? Best wishes, Matthew -- "The lyf so short, the craft so longe to lerne."