SAML2 AttributeService endpoints

[Cantor, Scott]

On 3/30/14, 12:04 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>As I understand it, a SAML2 AttributeService endpoint can lead to
>unnecessary queries and even spurious errors at the SP.

Is there some error you're thinking of? I can't think of anything offhand.

> I think I
>understand the conditions under which a Shibboleth SP will make an
>unnecessary attribute query but can this be avoided at the SP? I
>suspect it can't.

You can avoid it "globally" by commenting out the resolver, but I don't
think you can disable it selectively by protocol (it would turn it off for
both SAML versions).

>Which leads me to my main question: What do I tell IdP administrators?
>Can I tell them to remove a SAML2 AttributeService endpoint in all
>cases? Is there something in the Shibboleth IdP configuration that
>admins can look for?

It's not a question of looking at a configuration, it's about
understanding your use cases and requirements. Your configuration reflects
your requirements.

That said, there aren't too many people relying on SAML 2 queries that I
can think of. Research projects running local Attribute Authorities,
primarily, I would expect.

I don't think we're planning to enable this by default in V3.

-- Scott