SAML2 AttributeService endpoints

[Ian Young]

On 31 Mar 2014, at 12:15, Tom Scavo <trscavo at gmail.com> wrote:

> The SP is led to believe
> there's some issue at the IdP (which there is) and some poor admin may
> spend time contacting IdP tech support to resolve the issue only to
> find the IdP doesn't support SAML2 attribute query at all. <duh> The
> problem was (and still is) attribute release.
> 
> Meanwhile, the poor user is not getting the information s/he needs to
> resolve the problem, that is, the IdP does not release attributes.

My recollection is that you end up with pretty much the same thing presented to the user in the case where the attribute query endpoint is broken as in the case where it is working but doesn't return any attributes. There are differences in the SP logs, of course.

Unless I'm misremembering that, it doesn't seem to me as if a crusade to push IdPs to remove SAML 2 attribute service endpoints will deliver a meaningful improvement for the end user, or really for the SP deployer.

I'm not pushing for the opposite either, of course, I'm just asking whether we think effort applied in this direction really pays off.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5943 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20140331/490b59a4/attachment.bin