From 55dc42e1473e9cd174dab37d6485adaec1163ab8 Mon Sep 17 00:00:00 2001
From: Dane Barentine <dane.barentine@software.dell.com>
Date: Mon, 14 Sep 2015 14:02:10 -0700
Subject: [PATCH] KEYCLOAK-1491 AttributeStatement must contain one or more
 attribute or encryptedattribute statements

---
 .../main/java/org/keycloak/protocol/saml/SamlProtocol.java  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
index e4e8f6ecc7f..54dff3a5df6 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
@@ -448,8 +448,12 @@ public class SamlProtocol implements LoginProtocol {
         if (roleListMapper == null) return;
         AssertionType assertion = response.getAssertions().get(0).getAssertion();
         AttributeStatementType attributeStatement = new AttributeStatementType();
-        assertion.addStatement(attributeStatement);
         roleListMapper.mapper.mapRoles(attributeStatement, roleListMapper.model, session, userSession, clientSession);
+
+        //SAML Spec 2.7.3 AttributeStatement must contain one or more Attribute or EncryptedAttribute
+        if(attributeStatement.getAttributes().size() > 0) {
+            assertion.addStatement(attributeStatement);
+        }
     }