SAML2 AttributeService endpoints

[Tom Scavo]

On Sun, Mar 30, 2014 at 10:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 3/30/14, 12:04 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>>
>>As I understand it, a SAML2 AttributeService endpoint can lead to
>>unnecessary queries and even spurious errors at the SP.
>
> Is there some error you're thinking of? I can't think of anything offhand.

A situation something like the following: An IdP intentionally will
not release attributes to an SP for policy reasons. No attributes
arrive on the front channel (even though that's the IdP's usual mode
of operation) so the SP blindly attempts to query for attributes. Now
suppose the query fails for some other reason (e.g., misconfigured
certificate on the IdP end, network issue, unable to negotiate TLS
session, lack of protocol support, etc.). The SP is led to believe
there's some issue at the IdP (which there is) and some poor admin may
spend time contacting IdP tech support to resolve the issue only to
find the IdP doesn't support SAML2 attribute query at all. <duh> The
problem was (and still is) attribute release.

Meanwhile, the poor user is not getting the information s/he needs to
resolve the problem, that is, the IdP does not release attributes.

>>Which leads me to my main question: What do I tell IdP administrators?
>>Can I tell them to remove a SAML2 AttributeService endpoint in all
>>cases? Is there something in the Shibboleth IdP configuration that
>>admins can look for?
>
> It's not a question of looking at a configuration, it's about
> understanding your use cases and requirements. Your configuration reflects
> your requirements.

You gave me the clueful answer, but I'm looking for clueless answer. I
usually tell people: if your IdP *always* pushes attributes on the
front channel, you don't need a SAML2 AttributeService endpoint in
metadata, and in fact that can lead to unnecessary and even spurious
errors at the SP. If you don't use it, remove it.

What in the IdP configuration directs the IdP to push attributes on
the front channel? How do I configure an IdP to support (or not
support) SAML2 attribute query.

Seems to me the real problem is SAML1. If I could convince IdP admins
to stop supporting SAML1, no attribute query support would be needed,
period.

> That said, there aren't too many people relying on SAML 2 queries that I
> can think of.

But how do you know one when you see one?

Thanks,

Tom