SP credential in attribute query flow tests ?

[Cantor, Scott]

It was me, I switched the default config to the new relying-party and
profile configuration files, and I never set the flow properties that run
the security checking.

That doesn't have a major effect on the SSO profiles, but I don't like how
silently that worked for SOAP. OTOH, I'm not sure V2 was any different, I
don't know that it would fail if the security policy rules were just
removed. One of the rules is what actually checks for the request being
authenticated.

The SP, IIRC, works slightly differently. It actually checks the state of
the request in the profile processing code and bails out. The difference
is that if you want to omit security checking from the profile, you can't
just do it by accidentally not running the policy rules, you actually have
to install a dummy rule that sets the security state so the profile code
is satisfied.

I don't know what Brent thinks, but I personally prefer that model, it's
just less prone to failing unsafe.

-- Scott