.net Shibboleth在过期后未设置属性

我在asp.net应用程序的SAML身份验证中使用Shibboleth作为SP。Idp验证用户并将响应发送给shibboleth，shibboleth为Idp返回的每个属性设置http请求变量

下面的日志显示了两个身份验证请求。第一个我可以看到属性被正确发送，但是第二个没有任何属性被发送。属性通常在saml:AttributeStatement节点中的idp的xml响应中发送，但这不会出现在第二个请求中。下面的警告日志也显示了这一点

为什么在第二次请求时不会从Idp发送这些属性

在配置/日志中还有什么我可以查找的吗

我还没有能够始终如一地重现这个问题。我试着等到Shibboleth删除了它的缓存响应之后，我认为它会缓存来自idp？的响应，但有时idp会返回属性节点，有时则不会

Warn log:
2014-07-29 09:37:11 WARN Shibboleth.AttributeResolver.Query [32]: no SAML 2 AttributeAuthority role found in metadata

Shibd Log:
2014-07-29 09:29:39 INFO Shibboleth.SessionCache [32]: new session created: ID (_4a08732fafc683618ec84f743679a558) IdP (https://<idp url>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (<client ip>)
2014-07-29 09:37:10 INFO Shibboleth.SessionCache [32]: removed session (_4a08732fafc683618ec84f743679a558)
2014-07-29 09:37:11 WARN Shibboleth.AttributeResolver.Query [32]: no SAML 2 AttributeAuthority role found in metadata
2014-07-29 09:37:11 INFO Shibboleth.SessionCache [32]: new session created: ID (_ebfc98924b1bafc96a646a9e0ef97cd8) IdP (https://<idp url>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (10.60.112.1)
2014-07-29 09:37:12 INFO XMLTooling.StorageService : purged 8 expired record(s) from storage

Transaction Log:
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]: New session (ID: _4a08732fafc683618ec84f743679a558) with (applicationId: default) for principal from (IdP: https://<idp url>) at (ClientAddress: <client ip>) with (NameIdentifier: test@testdomain.com) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: id-eyHUtkCazAdXC6cMPibbv8YhuYc-)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]: Cached the following attributes with session (ID: _4a08732fafc683618ec84f743679a558) for (applicationId: default) {
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   username (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   userGUID (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   lastname (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   role (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   firstname (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   companyName (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   companyGUID (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]:   emailAddress (1 values)
2014-07-29 09:29:39 INFO Shibboleth-TRANSACTION [32]: }
2014-07-29 09:37:11 INFO Shibboleth-TRANSACTION [32]: New session (ID: _ebfc98924b1bafc96a646a9e0ef97cd8) with (applicationId: default) for principal from (IdP: https://<idp url>) at (ClientAddress: <client ip>) with (NameIdentifier: test@testdomain.com) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: id-jAnsCQo6-BH2skcHhzj8i63jKxQ-)
2014-07-29 09:37:11 INFO Shibboleth-TRANSACTION [32]: Cached the following attributes with session (ID: _ebfc98924b1bafc96a646a9e0ef97cd8) for (applicationId: default) {
2014-07-29 09:37:11 INFO Shibboleth-TRANSACTION [32]:   emailAddress (1 values)
2014-07-29 09:37:11 INFO Shibboleth-TRANSACTION [32]: }

---

如果您从某种远程系统OpenLDAP获取用户属性，…，请尝试检查您的网络连接。不可再现性可能是网络问题或远程系统停机时间的指标，例如重新启动

请注意，Shibboleth使用连接池来检索用户属性，因此在处理请求之前，连接可能已经断开

关于AttributeResolver.Query警告，能否确保SP上有IdP的元数据？两次登录尝试是否使用相同的IdP和SP？用户是否相同