RequestedAttributes and EntityAttributes

[Rod Widdowson]

Just checking my understanding of the code and your mail (this is my first
deep dive into this space)...

> >I need to find the right place to pluck the ACS from the entity and plug
> >it
> >into a AttributeConsumerServiceContext child of the SAMLMetadataContext
> 
> MessageHandler probably.
>
> It probably should happen on the inbound context, inside the per-profile
> config handler chain

So If I'm understanding you correctly, and reading the flows right, about
the same time as this (in the SAML2 abstract flow)

    <action-state id="DoProfileWork">
        <evaluate expression="InitializeAuthenticationContext" />
        <evaluate expression="InitializeRequestedPrincipalContext" />
        <evaluate expression="ProcessRequestedAuthnContext" />
        <evaluate expression="'proceed'" />
        
        <transition on="proceed" to="DoAuthenticationSubflow" />
    </action-state>

One question:  I cannot see indicated in any of the specs what the behaviour
should be if the AuthnRequest doesn't specify an
AttributeConsumingServiceIndex and the metadata doesn't have a default.  The
choice appears to either take an arbitrary one, or to return null.  Any
metadata that I looked at doesn't seem to specify default and in the case of
an IdPInitialized there won't be an acsIndex, so the former feels more
useful, but I don't have the experience to know whether that is correct and
safe (it would be compatible with V2 where we always took an arbitrary ACS).

> and then we'd modify the current profile action that
> copies inbound metadata context to outbound context to copy that one also.

Looks like this is InitializeOutboundMessageContext...

 Rod