How to retrieve SP required attributes at the IDP before authentication

[Dierick Bart]

Hey everyone, 

At the moment I'm working on a project in Shibboleth to create a new strong authentication and autorisation mechanism. At the moment the improved authentication phase is completed. But for the next step I'm a bit in trouble. 

In my implementation, the required attributes (for the SP) already have to be know before starting the authentication (so my loginhandler is loaded and then I need to know and retrieve the SP required attributes) before completing the authentication. 

After a lot of research I realised that it must be possible to provide the required attributes at the authentication request. I found inspiration at 

https://spaces.internet2.edu/display/InCCollaborate/SP+Attribute+Requirements

They suggest that the required attributes can be setted in the metadata OR in the authentication request. 

I was already able to put these attributes in the the metadata. But isn't it better to get these attributes in the authentication request? And by value instead of by reference? 

I don't find any information on how to force the Shibboleth SP to provide the required attributes in the saml2 authentication request. 

So my questions are: 

1) Is it possible to provide the required SP attributes before the authentication? 
2) What is the best (if I need the attributes in my loginhandler)? Get them out of the metadata of the SP or in the authentication request by value or reference? 
3) Is it than possible to use these attribute (information) in my loginhandler? 

Greetings 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120321/02df9f80/attachment.html