SAML2 AttributeService endpoints

[Tom Scavo]

On Mon, Mar 31, 2014 at 7:32 AM, Ian Young <ian at iay.org.uk> wrote:
>
> On 31 Mar 2014, at 12:15, Tom Scavo <trscavo at gmail.com> wrote:
>
>> Meanwhile, the poor user is not getting the information s/he needs to
>> resolve the problem, that is, the IdP does not release attributes.
>
> My recollection is that you end up with pretty much the same thing presented to the user in the case where the attribute query endpoint is broken as in the case where it is working but doesn't return any attributes. There are differences in the SP logs, of course.

I hope that's not the case. This is why we've started pushing SPs to
the Federated Error Handling Service.
(https://spaces.internet2.edu/x/kJOVAQ)

> Unless I'm misremembering that, it doesn't seem to me as if a crusade to push IdPs to remove SAML 2 attribute service endpoints will deliver a meaningful improvement for the end user, or really for the SP deployer.
>
> I'm not pushing for the opposite either, of course, I'm just asking whether we think effort applied in this direction really pays off.

Those are important observations. I'd be interested in hearing what
others think.

Thanks,

Tom